Release: Merge release into master from: release/merge-dev-into-master-3.4.304

components/package.json

@@ -1,6 +1,6 @@
 {
   "name": "defectdojo",
-  "version": "3.4.303",
+  "version": "3.4.304",
   "license": "BSD-3-Clause",
   "private": true,
   "dependencies": {

docs/content/admin/feature_flags/PRO__feature_flags.md

@@ -13,14 +13,23 @@ The Feature Flags page is visible to **superusers** only. Other users, including
 
 Go to **Settings > Feature Flags** in the left sidebar.
 
-The page lists every optional feature with:
+The header shows how many features are on, for example **26 of 56 Enabled**, and holds a search box that filters every feature by name or description.
 
-* **Name** — the feature, with a **BETA** tag when it is still in beta
-* **Description** — what the feature does
+Features are grouped by area, one card per area: **Findings and Triage**, **Assets and Locations** (or **Products and Locations** when relabeling is off), **Compliance and Regulatory**, **Connectors and Ingestion**, **AI and MCP**, **Interface and Workspace**, and **System and Support**. Each card shows how many of its features are listed, and the **MCP Server** row closes the **AI and MCP** card with its toolsets under it.
+
+Each feature row shows:
+
+* **Name**: the feature, with **NEW**, **BETA** and warning tags such as **Restart Recommended** where they apply
 * **Documentation link**: a link to that feature's documentation. Every feature on the page has one, and the [Feature reference](#feature-reference) below lists them all.
-* **Toggle** — whether the feature is currently on
+* **Description**: what the feature does, on one line. Hover the row, or move keyboard focus into it, to read the whole description in place. On a touch screen the whole description always shows.
+* **Toggle**: whether the feature is currently on
+
+The column beside the cards has two lists:
+
+* **Areas** lists every area with how many of its features are on. Click an area to scroll to its card.
+* **Show** narrows every card to **All**, **On**, **Off**, **New**, **Beta**, or **With Warnings** (features that carry a warning tag, such as **Restart Recommended** or **Experimental**). Each choice shows how many features it matches, and it combines with the search box. While a choice other than **All** is active, its name shows in the **Show** header.
 
-Use the search box to filter the list by feature name or description.
+On a narrow screen the two lists sit above the cards and start folded, so the features come first.
 
 ### Features that are not listed
 
@@ -132,6 +141,7 @@ Features under **MCP** appear on the Feature Flags page beneath the MCP server s
 | **AI Inventory and Governance** (BETA) | Inventory the AI in every scanned repository: coding assistants and their rules files, MCP servers, models, AI packages, AI service endpoints, agent skills and AI provider keys. Policies mark each component authorized, unauthorized or needs review, unauthorized components become Findings, and each Asset can export an AI bill of materials. Inventories that arrive while this is off are still stored and appear when it is turned on. Requires **Locations**. | Off | [Docs](/asset_modelling/locations/pro__ai_inventory/) |
 | **AI Threat Modeling** | Generate a STRIDE threat model, attacker profiles, attack paths and security requirements from a feature design with Sensei. | On | [Docs](/sensei/threat_modeling/) |
 | **Airgapped instance** | This instance has no route off its network, so it never contacts DefectDojo. The version check, external tools, announcements, threat intel downloads and error and performance diagnostics stop, and both support pages show the DefectDojo support address instead. Load threat intel bundles from a file. The DD_AIRGAPPED environment variable turns this on for the whole deployment. | Off | [Docs](/get_started/pro/onprem/airgapped/) |
+| **Asset Discovery** (BETA) | List the devices your EDR sees on the network that have no agent of its own, as CrowdStrike Falcon Discover and Microsoft Defender for Endpoint report them. Turn it on per connection with Report Unmanaged Devices. The devices are candidates: none becomes an Asset, and none counts toward Total Findings. | Off | [Docs](/asset_modelling/pro__unmanaged_devices/) |
 | **Asset Exposure** (BETA) | Compute whether an asset is reachable from outside, and whether a finding's code is actually deployed in production, from the evidence connectors already collect. Both feed prioritization; exposure can also drive the FedRAMP VDR SLA tiers. | Off | [Docs](/triage_findings/finding_scoring/asset_exposure/) |
 | **Asset Identity** | Let connectors find each Asset by the identifier its source uses instead of by name, and list every identifier it is known by on its Identity card. Records that are already mapped stay where they are. Turning this off goes back to matching by name; the identifiers are kept. | Off | [Docs](/asset_modelling/engagements_tests/pro__assets/#asset-identity-aliases) |
 | **Calendar** | Show the Calendar in the sidebar. The calendar plots engagements and tests on a month view. Turning this off removes the entry; it does not change any engagement or test dates. | On | [Docs](/navigation/pro__sidebar/) |
@@ -146,6 +156,7 @@ Features under **MCP** appear on the Feature Flags page beneath the MCP server s
 | **Customizable Page Layouts** | Customizable widget-grid layouts for the Organization, Asset, Engagement, Test, Finding, and Risk Acceptance view pages. | On | [Docs](/pro/page_layouts/) |
 | **Dashboards 2.0** | The redesigned customizable widget dashboard. | Off | [Docs](/metrics_reports/dashboards/custom-dashboards/) |
 | **EU Evidence Packs** (BETA) | Assess product evidence against authored CRA and DORA obligation catalogs, preserve assessor overrides, and generate dated evidence packs. Requires **Compliance**. | Off | [Docs](/federal_compliance/eu_evidence_packs/) |
+| **External Asset Discovery** (BETA) | Show the domains, IP addresses and certificates your scans and connectors report as Locations, on the location map and in the location lists. Locations that arrive while this is off are still stored and appear when it is turned on. Requires **Locations**. | Off | [Docs](/asset_modelling/locations/pro__attack_surface_locations/) |
 | **FDA Cyber Device Pack** (BETA) | Assess a cyber device against an authored catalog for section 524B of the Federal Food, Drug, and Cosmetic Act, and generate an evidence pack carrying the component inventory, the lifecycle metrics and the exported bill of materials. Requires **Compliance**. | Off | [Docs](/federal_compliance/fda_cyber_device_pack/) |
 | **Framework Presets** (BETA) | Apply a published framework's patch windows and scan cadence as one preset: preview the plan, apply it, revert it, and see when the applied settings drift. Ships with UK Cyber Essentials and the Australian Essential Eight. | Off | [Docs](/asset_modelling/pro_hierarchy/framework_presets/) |
 | **Global Component Deduplication** | Deduplicate Components globally across the instance instead of per Asset. | Off | [Docs](/triage_findings/finding_deduplication/pro__global_component_deduplication/) |
@@ -176,7 +187,6 @@ Features under **MCP** appear on the Feature Flags page beneath the MCP server s
 | **Smart Upload** | Upload scan results without naming the asset or engagement first, and triage what could not be matched from the Unassigned Findings queue. Turning this off removes Smart Upload and Unassigned Findings from the Connect menu. It does not delete anything, and any findings already imported through Smart Upload are unaffected. | On | [Docs](/import_data/pro/specialized_import/smart_upload/) |
 | **Support** | Open a support request, track its status, and vote on what other customers ask for. When off, the Support pages are hidden and this instance sends no support requests to DefectDojo. | On | [Docs](/navigation/pro__support/) |
 | **Triage Engine (formerly Rules Engine 2.0)** (BETA) | Build automation rules as visual node graphs that react to Finding events, with per-run traces and a delivery outbox. | Off | [Docs](/automation/triage_engine/about/) |
-| **Unmanaged Devices** (BETA) | List the devices your EDR sees on the network that have no agent of its own, as CrowdStrike Falcon Discover and Microsoft Defender for Endpoint report them. Turn it on per connection with Report Unmanaged Devices. The devices are candidates: none becomes an Asset, and none counts toward Total Findings. | Off | [Docs](/asset_modelling/pro__unmanaged_devices/) |
 | **Vulnerability Response Policies** (BETA) | Read the response-policy matrix, the unevaluated queue and the escalation queue, and export machine-readable response evidence. | Off | [Docs](/asset_modelling/pro_hierarchy/priority_sla/#vulnerability-response-policies) |
 
 ## Feature availability

docs/content/admin/notifications/about_notifications.md

@@ -127,6 +127,18 @@ None of these messages arrives once per run. A Connector with a dead credential
 
 The notification is on **🔔 Alerts** by default. Set it to Email, Slack or Teams on your notification settings page, under **Connections**. A Connector that is set up correctly but has never seen any data is a separate case, and it warns you when you save it rather than later.
 
+## Ingestion Health Notifications (Pro)
+
+With [Ingestion Health](/connectors/upstream/ingestion_health/) turned on, the **Ingestion Health Warning** notification covers the ways a source falls short that no other message reports:
+
+* **A Connector's or API import stream's volume drops.** A run succeeds and imports Findings, but far fewer than the source's 30-day baseline.
+* **An API import stream returns no Findings.** Its last import submitted none, against a baseline above zero.
+* **A source goes stale.** A Connector's or scheduled Triage Engine rule's schedule fired three times in a row without it running, or an API import stream has gone far longer than usual without a successful import (its imports stopped arriving, or keep failing).
+
+It is sent once per anomaly, never once per check, to superusers and to everyone who can see that source (the Connector View or Rule View permission, or for an API import stream, access to its Asset together with Connector View, which opens the page the message links to). A Connector's zero results and failed runs stay on the **Connector Health Warning** above, so no condition sends two messages.
+
+The notification is on **🔔 Alerts** by default. Set it to Email, Slack, Teams or a webhook on your notification settings page, under **Connections**; the setting is shown while Ingestion Health is on.
+
 ## Open-Source Considerations
 
 ### Specific overrides

docs/content/admin/sso/PRO__saml.md

@@ -48,9 +48,9 @@ A few things to know about this endpoint:
 
    - **SAML Attribute** is free text and must match the attribute name your IdP actually emits. Some IdPs (e.g. Entra ID / Azure AD) send fully qualified claim URIs such as `http://schemas.microsoft.com/identity/claims/emailaddress` rather than friendly names. If you are not sure what your IdP sends, enable **Enable SAML Debugging** (see [Troubleshooting](#troubleshooting)) and inspect the assertion in the logs.
    - **DefectDojo Field** is chosen from a list: **Username**, **First Name**, **Last Name** and **Email**.
-   - At minimum, map the attribute that corresponds to **Username**. DefectDojo looks users up by username when matching SAML logins to existing accounts.
-   - Mapping an attribute to **Email** is strongly recommended: DefectDojo uses the email address for notifications, and to match an incoming login to an existing account by email.
-   - The same attribute may feed more than one field — for example an email claim used for both **Email** and **Username**. The reverse is not allowed: each DefectDojo field may be mapped from only one attribute.
+   - A mapping fills user fields. It never decides which account a login lands on: DefectDojo always signs the login in to the account whose username equals the SAML `NameID` (see [Which account a login lands on](#which-account-a-login-lands-on)). A **Username** mapping is not used for that.
+   - Mapping an attribute to **Email** is strongly recommended: DefectDojo uses the email address for notifications.
+   - The same attribute may feed more than one field. The reverse is not allowed: each DefectDojo field may be mapped from only one attribute.
    - A row with only one half filled in is rejected on save, and the offending cell is highlighted. Rows you add but never fill in are discarded rather than treated as errors.
 
 8. **IdP metadata** — supply one of the two, not both:
@@ -102,7 +102,7 @@ IAM Identity Center can act as the SAML IdP through a customer managed SAML 2.0
 1. In the IAM Identity Center console, add a **customer managed** application of type **SAML 2.0**.
 2. Under **IAM Identity Center metadata**, download the **IAM Identity Center SAML metadata file**. Upload it to DefectDojo as **Local SAML Metadata** (step 8 of [Setup](#setup)), which works whether or not the instance can reach AWS.
 3. Under **Application metadata**, enter the values manually: set **Application ACS URL** to DefectDojo's [ACS URL](#acs-url-assertion-consumer-service) and **Application SAML audience** to the **Entity ID** you set in DefectDojo.
-4. Under **Attribute mappings**, map the subject and the attributes DefectDojo reads. For example, send `${user:email}` as the subject and as an `email` attribute, and `${user:givenName}` and `${user:familyName}` as first and last name. Then map those attribute names to **Username**, **Email**, **First Name** and **Last Name** in DefectDojo's **Attribute Mapping**.
+4. Under **Attribute mappings**, map the subject and the attributes DefectDojo reads. For example, send `${user:email}` as the subject and as an `email` attribute, and `${user:givenName}` and `${user:familyName}` as first and last name. Then map those attribute names to **Email**, **First Name** and **Last Name** in DefectDojo's **Attribute Mapping**. The subject is the `NameID`, so it decides which DefectDojo account each person signs in to.
 5. For group mapping, add an attribute such as `groups` mapped to `${user:groups}`, and enter the same name as DefectDojo's **Group Name Attribute**. DefectDojo names its groups after the exact values in the assertion, so turn on **Enable SAML Debugging** for a test login and check what Identity Center sends before you write the **Group Limiter Regex Expression**.
 6. Assign the users or groups who should have access to the application in IAM Identity Center.
 
@@ -140,6 +140,14 @@ DefectDojo Cloud does not have the same level of SAML customization as DefectDoj
 
 If you need to match users on an attribute other than NameID (such as `uid` or `email`), configure your Identity Provider to send the desired value as the NameID rather than adjusting DefectDojo settings.
 
+### Which account a login lands on
+
+A SAML login lands on the DefectDojo account whose username equals the `NameID` in the assertion. A mapped attribute never changes that, including one mapped to **Username**: the Attribute Mapping only fills fields such as the email address and the names.
+
+- Have your IdP send each person's DefectDojo username as the `NameID`. Many organizations use the email address as the DefectDojo username and send the email as the `NameID`.
+- Use a persistent `NameID` format. **Transient** issues a new `NameID` on every login, so it never matches an existing account.
+- With **Create Unknown User** on, a `NameID` that matches no username creates a new account. A `NameID` that differs from the username a person already has therefore creates a second account rather than signing them in to the first.
+
 ## Troubleshooting
 
 ### SAML Debugging output
@@ -158,12 +166,12 @@ Turn this option **off** after you've finished troubleshooting — SAML debug lo
 
 If the SAML assertion parses successfully (no XML or signature errors) but DefectDojo refuses the login, the most common cause is a **username mismatch** between the IdP and DefectDojo.
 
-DefectDojo looks up the user **by username** when matching a SAML login to an existing account. If the value your IdP sends as the `username` attribute does not match an existing DefectDojo user's username, the lookup fails — even though the rest of the assertion is valid.
+DefectDojo looks up the user **by the SAML `NameID`**, which must equal an existing DefectDojo username (see [Which account a login lands on](#which-account-a-login-lands-on)). If the `NameID` your IdP sends does not match, the lookup fails even though the rest of the assertion is valid. Mapping a different attribute to **Username** does not help: a mapped attribute is never used to find the account.
 
 Two remedies, pick whichever fits your environment:
 
-- **Drop `username` from the Attribute Mapping** and let DefectDojo fall back to using the SAML `NameID` as the username instead. This is appropriate if your DefectDojo usernames already match the NameID format your IdP emits.
-- **Align the usernames.** Make sure the usernames in DefectDojo are exactly what your IdP sends in the `username` claim. For most organizations the easiest convention is to make DefectDojo usernames equal to the user's email address, and have the IdP send the email as the `username` claim.
+- **Change what the IdP sends as the `NameID`** so it equals the DefectDojo username, for example the user's email address.
+- **Align the usernames.** Make sure the usernames in DefectDojo are exactly the `NameID` values your IdP sends. For most organizations the easiest convention is to make DefectDojo usernames equal to the user's email address, and have the IdP send the email as the `NameID`.
 
 If you're not sure what the IdP is actually sending, enable **Enable SAML Debugging** (above) and inspect the parsed attributes in the logs.