docs(psirt): Feed Rules, the no-SBOM matching path, and advisory-to-case - #15735
Merged
Conversation
Feed Rules had no page at all — the subsystem it documents was previously unreachable from the UI. It gets one, placed before Matching Rules in the setup flow to match the menu, because reading the advisory text is what works before any inventory exists. Matching Rules gains two sections that answer the question people actually arrive with. "Start From a Template" covers the template picker and, more importantly, the No SBOM needed / Needs SBOM labelling — a dependency-target rule on an instance with no inventory matches nothing however well written, and that silence is the most common reason people conclude matching is broken. "What to do when you have no SBOM" says the same thing directly, since the asset-target path has always existed and nothing pointed at it. Feed Findings documents the Feed Rules column and the Add to case action, and states plainly that escalating an advisory does not require it to have matched anything. Page weights shift by one from Feed Rules onward.
blakeaowens
approved these changes
Aug 19, 2026
Maffooch
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Documentation for three PSIRT changes landing in DefectDojo Pro.
Feed Rules gets a page. The pre-filter subsystem it describes — scoring,
tagging, starring and suppressing an advisory from its own text before anything
touches the inventory — previously had no way in from the UI, so there was nothing
to document. It is placed before Matching Rules in the setup flow, mirroring the
menu, because reading advisory text is what works before any inventory exists.
Matching Rules gains two sections that answer the question people actually
arrive with:
"No SBOM needed" / "Needs SBOM" labelling. A dependency-target rule on an
instance with no inventory matches nothing however well written, and that
silence is the most common reason people conclude matching is broken.
asset-target path has always existed and nothing pointed at it.
Feed Findings documents the Feed Rules column and the Add to case action, and
states plainly that escalating an advisory to a case does not require it to have
matched anything — an advisory the inventory could not answer for is frequently
the one most worth investigating.
Page weights shift by one from Feed Rules onward.
Docs-only: no code changes.