From b6d6812e3c04febcc95f85543bd3a71286aed8f5 Mon Sep 17 00:00:00 2001 From: Greg Anderson Date: Thu, 16 Jul 2026 23:38:57 -0600 Subject: [PATCH 1/2] docs(connectors): Harbor setup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a Harbor section to the connectors tool reference: prerequisites (a user or robot account with pull/read access) and connector mappings (Location, Username, Secret via HTTP Basic, Minimum Severity). Whole-registry model — a Record per project, scanned artifacts' vulnerabilities imported as findings. Pairs with connector DefectDojo-Inc/connectors#722 and registration DefectDojo-Inc/dojo-pro#1915. Co-Authored-By: Claude Opus 4.8 --- .../pro/connectors/connectors_tool_reference.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/docs/content/import_data/pro/connectors/connectors_tool_reference.md b/docs/content/import_data/pro/connectors/connectors_tool_reference.md index 45a3e49000d..981945689ba 100644 --- a/docs/content/import_data/pro/connectors/connectors_tool_reference.md +++ b/docs/content/import_data/pro/connectors/connectors_tool_reference.md @@ -493,6 +493,23 @@ The connector uses HackerOne's **customer** API, which requires an **organizatio Each program becomes a Record, and its reports are imported as findings with the HackerOne severity rating preserved. +## **Harbor** + +The Harbor connector uses the Harbor v2.0 REST API to import container image vulnerabilities across your whole registry. DefectDojo enumerates every Harbor **project** and creates a Record for each one, then walks the project's repositories and artifacts and imports the vulnerabilities from each **scanned** artifact — carrying the image (repository + tag/digest) as finding context. There is no per\-image configuration. + +#### Prerequisites + +You will need a Harbor account (or a **robot account**) with pull/read access to the projects you want to import. We recommend a dedicated robot account: in Harbor, open a project (or **Administration \> Robot Accounts** for a system robot), create a robot with the **pull** permission on repositories and artifacts, and copy its name (`robot$`) and secret. A regular username/password also works. + +#### Connector Mappings + +1. Enter your Harbor URL in the **Location** field — for example `https://harbor.example.com`. DefectDojo appends the `/api/v2.0` API path automatically. +2. Enter the Harbor username, or a robot account name (`robot$`), in the **Username** field. +3. Enter the password or robot account secret in the **Secret** field. It is sent using HTTP Basic authentication. +4. Optionally, set a **Minimum Severity** to limit which findings are imported. + +Each Harbor project becomes a Record. For every artifact that has a completed scan, its vulnerabilities are imported as findings; the affected package/version, a CVSS\-derived severity, the CVE, the CWE, and a remediation (fixed version) are included where Harbor provides them. Only scanned artifacts are imported — trigger a scan in Harbor for images that have not been scanned yet. + ## **Have I Been Pwned** The Have I Been Pwned (HIBP) connector uses the HIBP REST API to report which accounts on your organization's own domains have appeared in known data breaches. DefectDojo discovers each domain you have verified with HIBP and imports one finding per breach affecting that domain. From 23f1493641613080c06ae58066d8cb6e7fea062c Mon Sep 17 00:00:00 2001 From: Greg Anderson Date: Fri, 17 Jul 2026 17:17:23 -0600 Subject: [PATCH 2/2] docs(connectors): Harbor robot prefix is instance-configurable Live validation against demo.goharbor.io showed robot accounts there use a robot_ prefix rather than the default robot$ (the prefix is a per-instance Harbor setting). Tell users to copy the robot name exactly as Harbor displays it. Co-Authored-By: Claude Opus 4.8 --- .../import_data/pro/connectors/connectors_tool_reference.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/content/import_data/pro/connectors/connectors_tool_reference.md b/docs/content/import_data/pro/connectors/connectors_tool_reference.md index 981945689ba..c018123159c 100644 --- a/docs/content/import_data/pro/connectors/connectors_tool_reference.md +++ b/docs/content/import_data/pro/connectors/connectors_tool_reference.md @@ -499,12 +499,12 @@ The Harbor connector uses the Harbor v2.0 REST API to import container image vul #### Prerequisites -You will need a Harbor account (or a **robot account**) with pull/read access to the projects you want to import. We recommend a dedicated robot account: in Harbor, open a project (or **Administration \> Robot Accounts** for a system robot), create a robot with the **pull** permission on repositories and artifacts, and copy its name (`robot$`) and secret. A regular username/password also works. +You will need a Harbor account (or a **robot account**) with pull/read access to the projects you want to import. We recommend a dedicated robot account: in Harbor, open a project (or **Administration \> Robot Accounts** for a system robot), create a robot with the **pull** permission on repositories and artifacts, and copy its full name and secret. Robot names start with `robot$` by default, but the prefix is configurable per Harbor instance (some use `robot_`) — copy the name exactly as Harbor displays it. A regular username/password also works. #### Connector Mappings 1. Enter your Harbor URL in the **Location** field — for example `https://harbor.example.com`. DefectDojo appends the `/api/v2.0` API path automatically. -2. Enter the Harbor username, or a robot account name (`robot$`), in the **Username** field. +2. Enter the Harbor username, or a robot account name exactly as Harbor shows it (`robot$` by default), in the **Username** field. 3. Enter the password or robot account secret in the **Secret** field. It is sent using HTTP Basic authentication. 4. Optionally, set a **Minimum Severity** to limit which findings are imported.