Question about "Close old findings within this engagement." - unique closed findings?

[Whitehorse2]

So far, if several scans have been performed in one engagement with the same findings, some have been closed with the "Close old findings within this engagement." option after being fixed.

If several scans in a row contain the same findings, the findings from each scan are later counted as Closed Findings. This is actually correct, but also causes misinterpretations.

I would also need an overview and statistics with the unique closed vulnerabilities, is that already possible or perhaps worth a feature request?

[manuel-sommer]

Hi @Whitehorse2 ,
this request is even more complex. Some findings include line numbers due to SAST scans. If this line number changes due to development of that code (no closing of this vulnerability), a new finding will be generated and the other is closed.
This can't be tracked by DefectDojo as it can't be aware if the finding is in a new one in a different code part or was just moved due to development.
Summarizing: I don't know if metrics about unique closed vulnerabilities can be implemented in a satisfying manner at all.

[valentijnscholten]

@Whitehorse2 Have you tried using reimport? For reoccurring scans it might the better option as it creates less "noise" by avoiding duplicate findings or lots of closed "old" findings. It is still affected by the "line number" issue described by @manuel-sommer, but it might still be beneficial to try it out: https://docs.defectdojo.com/en/working_with_findings/finding_deduplication/avoiding_duplicates_via_reimport/

[Whitehorse2]

@manuel-sommer Isn't this currently also a problem if, for example, a dynamic port number changes in the description?
For example: #11695 (comment)

@valentijnscholten
Reimport is actually not what I had in mind, as I can no longer look directly at a scan date, but I will try.

[valentijnscholten]

Reimport does track its history where you can see how many / which findings where added/closed over time. But is indeed not possible to view an exact snapshot from the past. Might be a good feature request to raise :-)

[valentijnscholten]

Indeed if the line number or port number changes and there is no other (unique) way to identify findings/endpoints, then Defect Dojo will not be able to match the old and new situation.