Findings duplication after import more than once trivy scan reports

[mgsilva97]

Hi defect dojo team.

I'm using a script to import data reports to defectdojo via API. When I use this script, I have duplication on the findings. I've checked "deduplicate finds" and "Delete duplicates" but still receiving new findins when trivy report is imported for the same docker image.

Even if I use same engagements, duplicate entries are still there.

Could you please help me with this duplication entries in findings field?

I'm using v.2.47.1 ( release mode )

Thank you.

Deployment method (select with an X)

• [ ] Docker Compose
• [X] Kubernetes (helm installation)
• [ ] GoDojo

[valentijnscholten]

Are you using import or reimport? Do you have an example report or screenshots to share some examples?

The Trivy Sacn is using these fields for deduplication:

"Trivy Scan": ["title", "severity", "vulnerability_ids", "cwe", "description"],

So if any of these fields changes between scans, the findings will not be seen as duplicates. This sometimes happens with the description field if it contains dynamic data such as timestamps.

When I import the same report twice in https://demo.defectdojo.org the deduplication seems to work OK.