E09: Vulnerability Management¶

Goal: Findings from all sources normalised, deduplicated, attributed, prioritised, tracked to verified closure.

F01: Ingestion and normalisation¶

Story: As the platform, I want verified scan outputs forwarded to DefectDojo with the platform's credential, so that DD's parsers normalise them and no repo holds a DD key.
Technical: import-scan/reimport-scan per (app, repo, tool) test. Engagement naming aap-<scope>. close_old_findings semantics preserved per scope.
Depends on: DD deployed and hardened (R-08). E08-F01-S01.
AC: A re-import of the same scope does not duplicate DD findings. The DD key is in Key Vault, scoped to an API-only DD user with product-type-limited permissions.
Security: Least-privilege DD user. TLS to DD on a private endpoint.

Story: As an engineer, I want one finding per real issue across runs and sources, so that I'm not flooded with duplicates.
Technical: Pull from DD (API, incremental by updated), GHAS (E06-F02-S02), DT (via DD import or direct), cloud (E15). Compute fingerprints per data model section 4. Alias resolution for vuln IDs.
AC: 10 consecutive identical runs → 0 new findings (PS-6). A finding moving file/line (same GHAS alert) stays one finding. Upgrade to a still-vulnerable version stays one finding.
Tests: Fingerprint golden tests per type. Alias resolution tests.

AC: Transitions per platform architecture section 5.3. closed requires closure_evidence_id (DB-enforced, test T4). A regression of the same fingerprint → reopened. All transitions recorded in finding_events.
Tests: State machine property tests (no path to closed without evidence).

AC: P1/P2 FP requires a confirmer ≠ the marker (an AppSec engineer). FP rate per team computed. A quarterly sample list is generated.

AC: SLA from the risk-model version at detection. Breach flips sla_breached and triggers the escalation chain (governance section 5). Exception expiry restarts the clock at half the SLA.

AC: DD risk-accepted, GHAS dismissed (won't fix / false positive) and Checkov skips are ingested as suppressions. Without a platform exception they do not change platform status. "Unmanaged suppressions" metric per team.