Import Method Comparison
One of the things we understand at DefectDojo is that every company’s security needs are completely different. There is no one-size-fits-all approach. As your organization changes, having a flexible approach is key, and DefectDojo allows you to connect your security tools in a flexible way to match those changes.
Scan Upload Methods
When DefectDojo receives a vulnerability report from a security tool, it will create Findings based on the vulnerabilities contained within that report. DefectDojo acts as the central repository for these Findings where they can be triaged, remediated, or otherwise addressed by you and your team.
There are two main ways that DefectDojo can upload Finding reports.
- Via direct import through the UI
- Via API endpoint (allowing for automated data ingestion): See API Docs
DefectDojo Pro Methods
DefectDojo Pro users have an additional three methods to handle reports and data:
- Via Universal Importer or DefectDojo CLI, command line tools which leverage the DefectDojo API: See Universal Importer & DefectDojo-CLI guides
- Via Connectors for certain tools, an ‘out of the box’ data integration: See Connectors Guide
- Via Smart Upload for certain tools, an importer designed to handle infrastructure scans: See Smart Upload Guide
Comparing Upload Methods
| UI Import | API | Connectors (Pro) | Smart Upload (Pro) | |
|---|---|---|---|---|
| Supported Scan Types | All: see Supported Tools | All: see Supported Tools | Akamai API Security, Anchore, AWS Security Hub, BurpSuite, Checkmarx ONE, Dependency-Track, IriusRisk, JFrog Xray, Probely, Semgrep, SonarQube, Snyk, Tenable, Wiz | Nexpose, NMap, OpenVas, Qualys, Tenable |
| Automation? | Available via API: /reimport /import endpoints | Triggered from CLI Tools or external code | Connectors is an inherently automated feature | Available via API: /smart_upload_import endpoint |
Asset Hierarchy and organization
Each of these methods can create Asset Hierarchy on the spot. Asset Hierarchy refers to DefectDojo’s Organizations, Assets, Engagements or Tests: objects in DefectDojo which help organize your data into relevant context.
- Vulnerability data can be imported into an existing Asset Hierarchy. Organizations, Assets, Engagements and Tests can all be created in advance, and then data can be imported to that location in DefectDojo.
- The contextual Asset Hierarchy can be created at the time of Import. When importing a report, you can create a new Organization, Asset, Engagement and/or Test. This is handled by DefectDojo through the ‘auto-create context’ option. In DefectDojo OS, this option can only be accessed through the API. UI imports in DefectDojo OS will require Asset Hierarchy to be created first.