Fresh service integrate (Ticket plateform like Jira)

[jugalb-icpl]

Fresh service is like a ticket platform like Jira, I want to implement it same way Jira is implemented, I want to use it to push findings in it, and so on
Can anyone help with what and where I have to make changes ?

[mtesauro]

While I like the the idea of DefectDojo supporting other issue trackers, over the years the core contributors have found out that adding features that we can't test doesn't lead to a very good experience to the users of DefectDojo. So, in general the core contributors to the project are trying to make sure any any new functionality we take on can be maintained and tested as the project continues to grow and change over time. This is even more tricky when a commercial license is required to use the product.

This is even more a problem for Jira-like things. Unlike the parsers where there's a clear and well documented method to add a parser, the way Jira was implemented 8+ years ago, it's not abstracted at all and has little pieces of Jira code spread around multiple places in DefectDojo. There's not a set of methods you could implement and have issues flowing to the bug tracker of your choice. If Jira hadn't been part of DefectDojo for so long, we'd not add it today in the way we did so long ago.

So, while this is an interesting idea, we're not going to be adding additional issues tracking systems at this time for those reasons.

What I have seen people do in the past for non-Jira issue trackers is to an API integration to pull in findings to that issue tracker.

Generally speaking, how this has worked is:
(1) Establish a criteria for Findings to be 'ready' to be pulled into the issue tracker. Some people have done setting a Finding to active + verified. Others have used a specific tag added to the Finding. Both have their pluses and minuses. Your specific use-case and processes will help you figure out the best option.
(2) Once you have a way to get a list of Findings to move to an issue tracker, write code to call the API and:

• Get all the findings for that criteria (active + verified / tag)
• Add them to the issue tracking system - hopefully it also has an API you can call
• Have the code 'record' the largest Finding ID it pulled over, add the finding ID to the issue or otherwise keep track of the findings that have been sync'ed already.
• Future calls will exclude those findings that have already been sync'ed but otherwise follow the same steps as above.

I know one person who did it as bi-directional but that's very much dependent on what features are present in the specific issue tracker to know when an issue on the issue tracker changes e.g. webhook, eventbus, logging, etc so it's hard to provide any specific advice on doing that.

HTH