How to Migrate from PlexTrac to Dradis: Findings, Templates and Old Projects

1. Set your export date by your renewal, not the news

PlexTrac's commercial terms renew each order form for another year unless one side gives notice "at least 30 days prior to the end of the applicable term" (your order form may say otherwise). That gives you two dates. The first is your notice deadline, 30 days before the term ends: miss it and the order renews for a year, and the same terms call fees "non-refundable and non-cancelable". The second is the term end. From then on the customer must "immediately cease all use of the Offerings", and the terms describe no export window after that. Brinqa's acquisition announcement says the PlexTrac solutions "will continue operating as standalone offerings".

Check that your role has PlexTrac's "Ability to export reports" permission before you start. You're done with this step when you know both dates and have picked storage your team controls for every export below.

Follow PlexTrac acquisition Timeline.

2. Export every WriteupsDB repository to CSV

PlexTrac's WriteupsDB docs cover importing write-ups from a CSV and have no page about exporting them, and its API docs say PlexTrac "doesn't have the functionality to import/export all stored data". PlexTrac Labs fills that gap with writeups-csv-export, a Python script that exports every write-up in a repository to a CSV in PlexTrac's own import format.

You need Python 3, pip and pipenv. Based on the script's README:

git clone https://github.com/PlexTrac-Labs/writeups-csv-export.git
cd writeups-csv-export
pipenv install
pipenv run python main.py

The script asks for your instance URL, username and password, or reads them from config.yaml. Its sign-in to PlexTrac lasts 15 minutes. With the values in the config file and MFA off, the script signs in again by itself; with MFA on, it asks you again. Pick a repository, and the script saves the CSV in the exports folder. Run it once for each repository. Each run gives you one CSV, with one row per write-up.

3. Match PlexTrac's columns to your Dradis fields

Every Dradis issue is a set of named fields, and your report template reads the ones it needs. Rename the CSV's columns to match those field names before you upload. Below is the map to the issue fields in our Welcome Pack sample template. Your own template, built from your report, may use other names, such as a CVSS 3.1 score if that's what your clients get. Sending us the raw CSV instead (step 4)? Skip this step.

Three things in the export need attention:

• HTML in the text. The script writes the description and custom fields unchanged from PlexTrac's API, and the sample data in its main.py contains HTML tags, so expect tags in those columns. Dradis fields use Textile, a plain-text markup, so remove the tags or convert them.
• The score cell holds two values. PlexTrac writes a score and its vector into one cell, with :: between them, and its own example vector has no CVSS:4.0/ prefix. FIRST's CVSS v4.0 specification says a vector string begins with that label.
• Custom fields come out on every row. The README warns that the script exports every custom field for every write-up, so a field used by only some write-ups appears as an empty column on the rest.

Here's one row before and after, using the score cell from PlexTrac's CSV docs. The PlexTrac export, four of its columns:

The same write-up as a Dradis Issue Library entry:

#[Title]#
Example write-up

#[CVSSv4.BaseScore]#
5.7

#[CVSSv4.Vector]#
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:H/SC:H/SI:L/SA:N

#[Description]#
Description text.

#[Solution]#
Fix text.

4. Upload the CSV to the Issue Library, or send it to us

In Dradis Pro, open the Issue Library and click Upload entries. Our Issue Library guide puts it this way: "Each column can have its own field. The only firm requirement is that you need a Title column." Upload a few rows first and open the entries they create, then upload the rest.

If your library is big, or step 3 looks like a weekend you don't have, skip it. Send the raw CSV files to our support team, and we import the library for you at no extra cost. Either way, every write-up ends up as an Issue Library entry your testers can add to a project.

If you'd rather script it, the Issue Library has a REST API: POST each entry to /pro/api/addons/issuelib/entries with the fields in the #[Field]# format shown in step 3.

5. Send us one sample report from each template

PlexTrac lets an admin download each export template from Admin Dashboard, then Templates, then the Export templates tab. Keep those files for your archive, but don't send them to us as the spec. They're Word or Jinja files built around PlexTrac's own placeholders, and a Dradis Word template uses Word content controls instead, so the file itself can't carry over.

Export one report per template, filled with dummy findings, in Word, or PDF for a Jinja template, and send it. We rebuild it as a Dradis template: "tables, sections, charts, and custom styles included". We've built and maintained over 1,100 templates since 2010. During the 14-day trial, you use our sample templates. When you subscribe, we build yours, and the 30-day money-back guarantee starts when it's ready, so you find out whether it matches your report while you can still get your money back.

6. Archive old projects, and bring across only the live ones

For each report, use PlexTrac's Export report option (Reports, click the report, Export report) and save two files: the .ptrac file, which keeps the report's structure and stores images as Base64 text, and the Word or PDF you delivered. Dradis doesn't import .ptrac files, so keep each one as your record. If you need its findings in Dradis, get in touch and we'll help you extract them. PlexTrac's docs also say that "comments made within a report are not exported", so copy any review notes you need first.

For a project you still work on, such as an open retest, export the report as CSV and bring it into a Dradis project with the CSV importer: upload the file, then map each column to an issue field, an evidence field or a node label. The importer needs comma-separated files. Done looks like this: a folder of .ptrac and report files per client, and your live projects open in Dradis.

Is there an automated PlexTrac importer in Dradis?

Can I move to the free Dradis Community Edition instead?