DefectDojo DefectDojo | docs
Connectors

Upstream Connectors Tool Reference (Pro)

Note: Upstream Connectors are a DefectDojo Pro-only feature.

When setting up a Connector for a supported tool, you’ll need to give DefectDojo specific information related to the tool’s API. At a base level, you’ll need:

  • Location -a field whichgenerallyrefers to your tool’s URL in your network,
  • Secret - generally an API key.

Some tools will require additional API-related fields beyond Location and Secret. They may also require you to make changes on their side to accommodate an incoming Connector from DefectDojo.

image

Each tool has a different API configuration, and this guide is intended to help you set up the tool’s API so that DefectDojo can connect.

Whenever possible, we recommend creating a new ‘DefectDojo Bot’ account within your Security Tool which will only be used by the Connector. This will help you better differentiate between actions manually taken by your team, and automated actions taken by the Connector.

Asset Connectors

Most Connectors import findings from a security tool. Asset Connectors work differently: they import your asset inventory instead. An Asset Connector enumerates the assets that exist in an external platform (for example, the repositories in a GitLab group) and automatically creates and maintains the matching Assets and Organizations in DefectDojo. No findings are imported by an Asset Connector.

  • Discover and Sync both reconcile the asset list. New assets appear as NEW Records; once mapped (automatically, if auto-mapping is enabled), DefectDojo creates the Asset and groups it under an Organization derived from the tool — for example, the GitLab namespace or the Azure DevOps project.
  • If an asset is later removed upstream (for example, a repository is deleted), its mapped Record is flagged MISSING on the next Sync so your team can triage it. DefectDojo never silently deletes an Asset.

Azure DevOps, Backstage, Bitbucket, GitHub, GitLab, JSM Assets, and ServiceNow CMDB are Asset Connectors. runZero is primarily an Asset Connector but can optionally import vulnerabilities as findings. All other Connectors listed below import findings.

Supported Connectors

Prev
Jira (Legacy)
Next
Downstream Connectors Tool Reference