Tool-Specific Connector Setup

Note: Connectors are a DefectDojo Pro-only feature.

When setting up a Connector for a supported tool, you’ll need to give DefectDojo specific information related to the tool’s API. At a base level, you’ll need:

Location -a field whichgenerallyrefers to your tool’s URL in your network,
Secret - generally an API key.

Some tools will require additional API-related fields beyond Location and Secret. They may also require you to make changes on their side to accommodate an incoming Connector from DefectDojo.

Each tool has a different API configuration, and this guide is intended to help you set up the tool’s API so that DefectDojo can connect.

Whenever possible, we recommend creating a new ‘DefectDojo Bot’ account within your Security Tool which will only be used by the Connector. This will help you better differentiate between actions manually taken by your team, and automated actions taken by the Connector.

Asset Connectors

Most Connectors import findings from a security tool. Asset Connectors work differently: they import your asset inventory instead. An Asset Connector enumerates the assets that exist in an external platform (for example, the repositories in a GitLab group) and automatically creates and maintains the matching Products (Assets) and Product Types (Organizations) in DefectDojo. No findings are imported by an Asset Connector.

Discover and Sync both reconcile the asset list. New assets appear as NEW Records; once mapped (automatically, if auto-mapping is enabled), DefectDojo creates the Product and groups it under a Product Type derived from the tool — for example, the GitLab namespace or the Azure DevOps project.
If an asset is later removed upstream (for example, a repository is deleted), its mapped Record is flagged MISSING on the next Sync so your team can triage it. DefectDojo never silently deletes a Product.

Azure DevOps, Backstage, Bitbucket, GitHub, GitLab, Jira Service Management Assets, and ServiceNow CMDB are Asset Connectors. runZero is primarily an Asset Connector but can optionally import vulnerabilities as findings. All other Connectors listed below import findings.

Supported Connectors

Acunetix 360

The Acunetix 360 connector imports DAST vulnerability findings from the Acunetix 360 cloud platform (the Invicti platform). DefectDojo discovers your account’s scanned websites and creates a Record for each website; the findings for a website come from its latest completed scan.

Please note: this connector is for Acunetix 360 (the cloud product at online.acunetix360.com). It is not for the on-premises Acunetix Standard/Premium scanner, which has a different API.

Prerequisites

An Acunetix 360 account and an API credential: in Acunetix 360, open your account menu > API Settings, and note the API User ID and generate an API Token. The connector authenticates with these as HTTP Basic credentials, so a dedicated service account is recommended to distinguish automated activity from manual team actions.

Connector Mappings

Enter your Acunetix 360 URL in the Location field: https://online.acunetix360.com.
Enter the API User ID in the API User ID field.
Enter the API Token in the API Token field.
Optionally, set a Minimum Severity to limit which findings are imported.

Each scanned website becomes a Record. Findings come from the website’s latest completed scan; vulnerabilities Acunetix 360 has marked Accepted Risk or False Positive are still imported but flagged inactive (risk-accepted or false-positive) so the DefectDojo product reflects the vendor’s triage.

Akamai API Security

The Akamai API Security connector uses an API key to pull security findings from the Akamai API. DefectDojo will discover your Akamai environment and create separate Records for each Application and Host configured in your account.

Prerequisites

You will need an API key with access to the Akamai API. We recommend creating a dedicated service account for DefectDojo to clearly distinguish automated activity from manual team actions.

Connector Mappings

Enter your Akamai API base URL in the Location field. This URL is specific to your Akamai instance: for example
Enter a valid API Key in the Secret field.

DefectDojo will map Applications and Hosts as separate Records. Each Application will appear as {name} (application) and each Host as {name} (host) in your Records list.

Anchore

The Anchore connector uses a user’s API token to pull data from Anchore Enterprise. Products will be mapped and discovered based on “Applications”, which are composed of multiple Images in Anchore - see Anchore Enterprise Documentation for more information.

Connector Mappings

The Anchore URL in the Location field: this is the URL where you access the Anchore.
Enter a valid API Key in the Secret field. This is the API key associated with your Burp Service account.

See the official Anchore documentation for more information on creating a token for Anchore.

AWS Security Hub

The AWS Security Hub connector uses an AWS access key to interact with the Security Hub APIs.

Prerequisites

Rather than use the AWS access key from a team member, we recommend creating an IAM User in your AWS account specifically for DefectDojo, with that user’s permissions limited to those necessary for interacting with Security Hub.

AWS’s “**AWSSecurityHubReadOnlyAccess**policy” provides the required level of access for a connector. If you would like to write a custom policy for a Connector, you will need to include the following permissions:

A working policy definition might look like the following:

{  
    "Version": "2012-10-17",  
    "Statement": [  
        {  
            "Sid": "AWSSecurityHubConnectorPerms",  
            "Effect": "Allow",  
            "Action": [  
                "securityhub:DescribeHub",  
                "securityhub:GetFindingAggregator",  
                "securityhub:GetFindings",  
                "securityhub:ListFindingAggregators"  
            ],  
            "Resource": "*"  
        }  
    ]  
}

Please note: we may need to use additional API actions in the future to provide the best possible experience, which will require updates to this policy.

Once you have created your IAM user and assigned it the necessary permissions using an appropriate policy/role, you will need to generate an access key, which you can then use to create a Connector.

Connector Mappings

Enter the appropriate AWS API Endpoint for your region in the Location field**:** for example, to retrieve results from the us-east-1 region, you would supply

https://securityhub.us-east-1.amazonaws.com 2. Enter a valid AWS Access Key in the Access Key field. 3. Enter a matching Secret Key in the Secret Key field.

DefectDojo can pull Findings from more than one region using Security Hub’s cross-region aggregation feature. If cross-region aggregation is enabled, you should supply the API endpoint for your “Aggregation Region”. Additional linked regions will have ProductRecords created for them in DefectDojo based on your AWS account ID and the region name.

Azure DevOps

The Azure DevOps connector is an Asset Connector: it enumerates the git repositories in every project of your Azure DevOps organization and creates a DefectDojo Asset for each repository, grouped into Organizations by Azure DevOps project. No findings are imported.

Prerequisites

You will need a Personal Access Token (PAT) for the organization. We recommend creating the token from a dedicated service account. Only read scopes are required:

In Azure DevOps, open User settings > Personal access tokens > New Token.
Click Show all scopes, then select Code: Read and Project and Team: Read.

Only Azure DevOps Services (dev.azure.com) is supported; on-premise Azure DevOps Server is not supported at this time.

Connector Mappings

Enter your organization URL in the Location field: https://dev.azure.com/{your-organization}. Legacy https://{your-organization}.visualstudio.com URLs are also accepted, and any extra path segments (for example, a link to a specific project) are ignored.
Enter the PAT in the Secret field.

Each repository becomes a Record named after the repository, grouped by its Azure DevOps project. Disabled repositories are skipped, so disabling or deleting a repository flags its Record as MISSING on the next Sync.

Backstage

The Backstage connector is an asset connector: instead of importing Findings, it pulls your Backstage Software Catalog into DefectDojo and keeps your Product hierarchy and team ownership in sync with it. It is designed for organizations that maintain their service inventory and org structure in Backstage and want DefectDojo to mirror that structure instead of maintaining it by hand.

What gets mapped

Backstage	DefectDojo
System	Product Type (Components with no System are grouped under a configurable “Backstage / Uncategorized” Product Type)
Component	Product — named from the entity `title` (falling back to `name`), with the catalog description
Owning Group (`ownedBy` relation)	A DefectDojo Group linked to the Product (default role: Maintainer, configurable)
Owner email (Group profile email, or a User owner’s email)	A Product Member, when a DefectDojo user with that email already exists (users are never created)
`metadata.tags`, `spec.type`, `spec.lifecycle`, namespace, domain	Product tags under a `backstage:` prefix
`metadata.annotations`	Stored on the Record (bounded); selected annotations can be promoted to first-class attributes or tags via Annotation Mappings

Records are keyed by the entity’s server-assigned metadata.uid, so renames in Backstage update the mapped Product in place on the next sync — no duplicates. The Product name always tracks the catalog: to rename a Product managed by this connector, rename the Component in Backstage (a DefectDojo-side rename, or a custom name given during manual mapping, is reconciled back to the catalog name on the next sync unless it would collide with another Product). Ownership changes move the Product’s group assignment. Components that disappear from the catalog (or are flagged with the backstage.io/orphan annotation) are marked MISSING — DefectDojo never deletes a Product on its own. Domain and Group hierarchy (parent teams) are recorded as tags/metadata only; they do not create extra hierarchy levels.

Prerequisites

The connector authenticates with a static external access token against the Backstage backend. In your Backstage app config, define a token and (recommended) restrict it to the catalog plugin:

backend:
  auth:
    externalAccess:
      - type: static
        options:
          token: ${DEFECTDOJO_BACKSTAGE_TOKEN}
          subject: defectdojo-connector
        accessRestrictions:
          - plugin: catalog

Generate a strong random token (for example openssl rand -hex 32) and store it in your Backstage deployment’s environment. See the Backstage service-to-service auth documentation for details.

Connector Mappings

Enter your Backstage backend root URL in the Location field: for example https://backstage.example.com (the connector appends /api/catalog). This must be the backend URL, not the frontend web UI.
Enter the static external access token in the Secret field.

Optional fields (leave blank for the defaults):

Namespaces — comma-separated catalog namespaces to import; blank imports every namespace.
Component Types — comma-separated spec.type values (e.g. service,website); blank imports every type.
Page Size — catalog query page size (1-500, default 250).
TLS Verification — set to false only if Backstage serves a certificate DefectDojo cannot verify (internal CA); not recommended.
Uncategorized Product Type — the Product Type used for Components with no System (default Backstage / Uncategorized).
Owner Group Role — the role granted to the owning team on mapped Products (default Maintainer).
Annotation Mappings — a JSON object mapping annotation keys to Record attribute names, or to "tag" to import an annotation as a Product tag, e.g. {"github.com/project-slug": "GITHUB_PROJECT", "example.com/tier": "tag"}.

With Auto-Map enabled, a single Discover + Sync builds the complete Product Type / Product / ownership structure with no manual steps. With Auto-Map disabled, discovered Components appear as Records awaiting your mapping decision.

Limitations (v1)

Backstage Group membership is not synchronized: the connector creates/links the owning team as a DefectDojo Group, but populating that group’s users is left to your identity provider or admins.
Only Components become Products; APIs, Resources, and Domains are not imported as assets (domains surface as tags).
Tags and annotations are normalized and bounded to fit DefectDojo field limits (oversized values are truncated).

A note on the reverse direction: displaying DefectDojo findings and grades inside Backstage (on entity pages) is a natural follow-on that would be built as a Backstage frontend plugin consuming the DefectDojo REST API — it is deliberately out of scope for this connector, which only pulls catalog data into DefectDojo.

Black Duck

The Black Duck connector imports software composition analysis (SCA) findings from a Black Duck (Synopsys / Black Duck) Hub instance. DefectDojo discovers every project in the instance and creates a Record for each project; the findings for a project come from the vulnerable BOM components of its selected version.

Prerequisites

A Black Duck API token for a user that can see the projects you want to import. In Black Duck, open your user menu > My Access Tokens > Create New Token, grant it (at least) read access, and copy the token when it is shown — it is displayed only once. The connector exchanges this token for a short-lived bearer on each sync; it is never stored in cleartext beyond the connector’s secret field.

Connector Mappings

Enter your Black Duck hub URL in the Location field — for example https://your-company.app.blackduck.com.
Enter the API token in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

Each Black Duck project becomes a Record. By default the connector imports the project’s released version (falling back to its first version); each vulnerable BOM component of that version becomes a finding, titled {vulnerability} in {component}:{version}.

Bitbucket

The Bitbucket connector is an Asset Connector: it enumerates the repositories in the Bitbucket Cloud workspaces you name and creates a DefectDojo Asset for each repository, grouped into Organizations by Bitbucket project. No findings are imported.

Prerequisites

Bitbucket Cloud requires a scoped Atlassian API token — classic (unscoped) Atlassian API tokens are rejected by Bitbucket with an “API Token provided has no Bitbucket scopes” error.

Go to id.atlassian.com/manage-profile/security/api-tokens and choose Create API token with scopes.
Select the Bitbucket app, then grant the read scopes: read:account:bitbucket, read:workspace:bitbucket, read:repository:bitbucket, and read:project:bitbucket.

Only Bitbucket Cloud (bitbucket.org) is supported. Bitbucket Server reached end of life in 2024, and Bitbucket Data Center is not supported.

Connector Mappings

Enter https://bitbucket.org in the Location field.
Enter the Atlassian account email the token belongs to in the Email field.
Enter the scoped API token in the Secret field.
Enter one or more workspace slugs (comma-separated) in the Workspace Slugs field. This field is required: Bitbucket’s scoped API tokens cannot list workspaces automatically, so DefectDojo needs to be told which workspaces to read.

Each repository becomes a Record named after the repository, grouped by its Bitbucket project.

Black Duck

The Black Duck connector uses the Black Duck API to import findings from your Black Duck server. DefectDojo creates a Record for each Black Duck project.

Connector Mappings

Enter your Black Duck server base URL in the Location field.
Enter a valid API token in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

This connector is distinct from the file-based Black Duck parsers — its findings use the dedicated Black Duck - Connectors Import scan type.

Bugcrowd

The Bugcrowd connector uses the Bugcrowd REST API to import submissions from your bug bounty and vulnerability disclosure programs. DefectDojo discovers the programs your API token can access and creates a Record for each one, importing that program’s submissions as findings.

Prerequisites

You will need a Bugcrowd API token with access to the programs you want to import. We recommend creating a dedicated service account for DefectDojo so automated activity is easy to distinguish from manual team actions. Generate the token in Bugcrowd under Organization settings > API credentials; read access to submissions, programs, and targets is sufficient.

Connector Mappings

Enter https://api.bugcrowd.com in the Location field.
Enter your Bugcrowd API token in the Secret field. It is sent as an Authorization: Token header.
Optionally, set a Minimum Severity to limit which findings are imported.

Each Bugcrowd program becomes a Record, and its submissions are imported as findings with the Bugcrowd severity preserved. Duplicate submissions are excluded, so reimport does not create repeated findings for the same issue.

Bright Security

The Bright Security connector uses the Bright (formerly NeuraLegion) API to import DAST findings. DefectDojo discovers every scan the token can access and creates a Record for each completed scan, then imports that scan’s issues as findings.

Prerequisites

You will need a Bright API key, created in the Bright app under User settings → API keys (an Org or personal key). The key is sent in the Authorization: Api-Key header and is never logged.

Connector Mappings

Leave the Location field blank to use https://app.brightsec.com, or enter your Bright host explicitly.
Enter the Bright API key in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

DefectDojo maps each completed scan to a Record and each issue to a finding: the severity comes from Bright’s own rating (Critical/High/Medium/Low), the CVSS score, CWE and remediation are carried over, the affected entry point becomes the endpoint, and the request/response evidence is included in the description. Findings are recorded as dynamic findings and de-duplicated on Bright’s issue id.

See the Bright API documentation for more information.

BurpSuite

DefectDojo’s Burp connector calls Burp’s GraphQL API to fetch data.

Prerequisites

Before you can set up this connector, you will need an API key from a Burp Service Account. Burp user accounts don’t have API keys by default, so you may need to create a new user specifically for this purpose.

See Burp Documentation for a guide on setting up a Service Account user with an API key.

Connector Mappings

Enter Burp’s root URL in the Location field: this is the URL where you access the Burp tool.
Enter a valid API Key in the Secret field. This is the API key associated with your Burp Service account.

See the official Burp documentation for more information on the Burp API.

Censys

The Censys connector reads host assets from the Censys Platform and imports each host’s exposed services as findings. It uses the Censys Platform global search API to enumerate the hosts you scope it to.

Prerequisites

You will need a Censys Platform account with API access:

A Personal Access Token, created in the Censys Platform Console under Personal Access Tokens.
Your Organization ID, shown on the same settings page under “Current Organization”. API access to the search endpoint requires an organization, so a Starter tier or higher is needed. Free-tier tokens have no organization ID and cannot use the search API.

Per-host CVE and risk data is available only on Censys Core (enterprise) tiers, so on lower tiers findings represent exposed services rather than vulnerabilities.

See the Censys Platform API documentation for more information.

Connector Mappings

Enter https://api.platform.censys.io in the Location field.
Enter your Personal Access Token in the API Key field.
Enter your Organization ID.
Enter a Search Query that scopes the import to your own assets, for example host.autonomous_system.asn: <your ASN> or host.ip: 203.0.113.0/24.
Optionally, set a Minimum Severity to limit which findings are imported.

DefectDojo creates a Record for each host and imports its exposed services as findings.

Checkmarx ONE

DefectDojo’s Checkmarx ONE connector calls the Checkmarx API to fetch data.

Connector Mappings

Enter your Tenant Name in the Checkmarx Tenant field. This name should be visible on the Checkmarx ONE login page in the top-right hand corner:
" Tenant: <your tenant name> "
Enter a valid API key. You may need to generate a new one: see Checkmarx API Documentation for details.
Enter your tenant location in the Location field. This URL is formatted as follows:
https://<your-region>.ast.checkmarx.net/ . Your Region can be found at the beginning of your Checkmarx URL when using the Checkmarx app. https://ast.checkmarx.net is the primary US server (which has no region prefix).

Branch handling

By default, each sync imports the findings of a project’s single most recent completed scan, regardless of branch. If your CI scans many branches, whichever branch happened to scan last “wins” that sync: findings that only exist on other branches are not imported, and the sync’s close-old reconciliation can churn findings open and closed as different branches take turns being the latest scan.

Two optional fields control this behavior:

Branch: pins every project to one branch name — only scans of that branch are imported. This is a single global value for the whole connector, so it fits fleets where every project uses the same long-lived branch (e.g. main).
Track Scanned Branches: when enabled, each sync finds every branch with a completed scan in the project’s recent scan history and imports the latest completed scan of each branch, one reimport per branch. Each branch’s findings live in their own engagement on the mapped asset, named “<default engagement> - <branch>”, so closing stale findings is scoped per branch: a fix merged to one branch can never close another branch’s findings. The project’s primary branch (as reported by Checkmarx) is imported first, so re-occurrences of the same finding on other branches deduplicate against the primary branch’s original.

Notes on Track Scanned Branches:

The toggle is off by default; existing connector configurations are unaffected until you enable it.
When both fields are set, only the pinned Branch is tracked.
A branch that stops being scanned (merged or deleted) stops receiving updates: its engagement remains visible with its last-known findings, which you can review and close in bulk.
Turning the toggle off later is safe: per-branch engagements simply stop receiving imports and the default engagement resumes on the next sync.
Connectors reconcile state on the sync schedule. Branch tracking makes each sync complete across branches; it does not make data real-time between syncs.

Cloudflare

The Cloudflare connector imports Security Center insights — security posture issues Cloudflare surfaces about your account and zones, such as a missing DMARC record, DNSSEC not being enabled, or a certificate problem. DefectDojo creates a Record for each zone (domain) that has open insights, plus an account-level Record for insights that are not tied to a specific zone.

Prerequisites

You will need a Cloudflare API token (not the legacy Global API Key). Create one under My Profile > API Tokens > Create Token in the Cloudflare dashboard. The quickest option is the “Read all resources” template; for a least-privilege token, grant Zone > Zone > Read (all zones) plus account-level read access for Security Center.

Connector Mappings

Enter https://api.cloudflare.com/client/v4 in the Location field.
Enter the API token in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

DefectDojo auto-discovers the accounts and zones the token can access — no account ID is required. Only open (active, non-dismissed) insights are imported, so insights you resolve or dismiss in Cloudflare are automatically mitigated in DefectDojo on the next sync.

Cobalt.io

The Cobalt.io connector uses the Cobalt.io API (v2) to pull pentest findings from your Cobalt.io organization. DefectDojo discovers every organization your API token can access and creates a separate Record for each asset (the unit Cobalt pentests).

Prerequisites

You will need a Cobalt.io personal API token. We recommend creating a dedicated service account for DefectDojo to clearly distinguish automated activity from manual team actions. Generate a token from Settings > API Tokens in the Cobalt.io UI. Organization tokens are discovered automatically - you do not need to supply them.

Connector Mappings

Enter the Cobalt.io API base URL in the Location field: https://api.cobalt.io (or your regional host, for example https://api.us.cobalt.io).
Enter your personal API token in the Secret field.
Optionally, enter an Organization Token to pin the sync to a single organization. When left blank, DefectDojo syncs every organization the personal API token can access.

DefectDojo maps each Cobalt.io asset as a separate Record. Findings are imported for each mapped asset, with their Cobalt.io state (for example valid_fix, wont_fix, invalid) driving the finding status in DefectDojo.

Contrast

The Contrast connector uses the Contrast Assess REST API to import application vulnerabilities. DefectDojo discovers the applications in your Contrast organization and creates a Record for each one.

Prerequisites

You will need four values from Contrast. We recommend creating a dedicated service account so automated activity is easy to distinguish from your team’s manual actions. In the Contrast UI, under User Settings > Profile > Your Keys, you can find:

Your organization API Key.
Your personal Service Key.
The username the credentials belong to (the account’s login email).
Your Organization ID — the UUID of the organization to import from, also shown under Organization Settings.

Connector Mappings

Enter the base URL you use to access Contrast in the Location field — for the hosted product this is typically https://app.contrastsecurity.com (or your regional / self-hosted Team Server URL).
Enter the account login email in the Username field.
Enter the organization API Key in the API Key field.
Enter the personal Service Key in the Service Key field.
Enter the Organization ID (UUID) in the Organization ID field.
Optionally, set a Minimum Severity to limit which findings are imported.

Each Contrast application becomes a Record, and its vulnerabilities are imported as findings.

Coverity

The Coverity connector imports findings from a Coverity Connect server. DefectDojo creates a Record for each Coverity project.

Connector Mappings

Enter your Coverity Connect server URL in the Location field.
Enter the Coverity Connect username in the Username field.
Enter the user’s password or authentication key in the Secret field.
Optionally, set a View Name to select which saved issues view the connector reads. Leave blank to use the default, Outstanding Issues.
Optionally, set Import All Issue Kinds to true to widen the import beyond the default Security and Quality (RESOURCE_LEAK) issue filter.

CrowdStrike Falcon

The CrowdStrike Falcon connector imports Spotlight vulnerabilities and EDR detections from the Falcon platform, as two separate finding types (CrowdStrike:Spotlight and CrowdStrike:Detections). DefectDojo creates a Record for each Falcon host.

Prerequisites

A Falcon API client (Client ID and secret), created in the Falcon console under Support > API Clients and Keys. Grant it the scopes for the data you want to import: Hosts: Read (required, for host discovery), Vulnerabilities (Spotlight): Read (for Spotlight findings), and Alerts: Read (for EDR detections). The two finding types are independent — if the client lacks a scope, that finding type is skipped rather than failing the sync, so a client without Alerts: Read still imports Spotlight vulnerabilities.

Connector Mappings

Enter your Falcon cloud’s API base URL in the Location field, matching your console region — for example https://api.crowdstrike.com (US-1), https://api.us-2.crowdstrike.com (US-2), https://api.eu-1.crowdstrike.com (EU-1), or https://api.laggar.gcw.crowdstrike.com (US-GOV-1).
Enter the API client’s Client ID in the Client ID field.
Enter the API client’s secret in the Client Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

Each Falcon host becomes a Record, named for its hostname, OS, and type. Only open and reopened Spotlight vulnerabilities are imported, so reimport closes remediated findings.

Deepfence ThreatMapper

The Deepfence ThreatMapper connector uses the ThreatMapper management-console REST API to import vulnerability scan results. DefectDojo discovers every node ThreatMapper has scanned — a container image, host, or container — and creates a Record for each, then imports that node’s most recent completed scan as findings.

Prerequisites

You will need a ThreatMapper API token, found in the console under Settings → User Management (your user’s API key). The connector exchanges it for a short-lived access token on each sync; the API token is never logged.

Connector Mappings

Enter your ThreatMapper console URL in the Location field (for example https://threatmapper.example.com).
In the Secret field, enter the ThreatMapper API token.
If your console uses a self-signed certificate, set Skip TLS Verification to true.
Optionally, set a Minimum Severity to limit which findings are imported.

DefectDojo maps each scanned node to a Record and each CVE in its latest completed vulnerability scan to a finding. The severity comes from ThreatMapper’s own rating, and the affected package, CVSS score, fix version (as mitigation), reference links, and a details block are carried over. Findings are recorded as dynamic findings and de-duplicated on the node, CVE, package and package path.

See the ThreatMapper documentation for more information.

Dependency-Track

This connector fetches data from a on-premise Dependency-Track instance, via REST API.

Connector Mappings

Enter your local Dependency-Track server URL in the Location field.
Enter a valid API key in the Secret field.

To generate a Dependency-Track API key:

Access Management: Navigate to Administration > Access Management > Teams in the Dependency-Track interface.
Teams Setup: You can either create a new team or select an existing one. Teams allow you to manage API access based on group membership.
Generate API Key: In the selected team’s details page, find the “API Keys” section. Click the + button to generate a new API key.
Assign Permissions: In the “Permissions” section of the team’s page, click the + button to open the permissions selector. Choose VIEW_PORTFOLIO and VIEW_VULNERABILITY permissions to enable API access to project portfolios and vulnerability details.
Click “Select” to confirm and save these permissions.

For more information, see Dependency-Track Documentation.

Docker Scout

The Docker Scout connector uses the Docker Scout metrics exporter API to report the vulnerability posture of your organization’s images. DefectDojo discovers each Docker Scout stream (your runtime environments) and imports a summary of the vulnerabilities and policy compliance for each.

Prerequisites

You will need a Docker personal access token created by an owner of a Docker organization that is enrolled in Docker Scout. The metrics exporter is an organization-level feature, so a personal account, or an organization that is not enrolled in Docker Scout, will not return data.

Create the token from your Docker account settings under Personal access tokens, and note your Docker organization namespace, which you will also need.

Connector Mappings

Enter https://api.scout.docker.com in the Location field.
Enter your Docker personal access token in the Secret field.
Enter your Docker Organization namespace.
Optionally, set a Minimum Severity to limit which findings are imported. Findings below the selected severity will not be imported.

DefectDojo creates a separate Record for each Docker Scout stream, and imports one finding per severity for the vulnerabilities Docker Scout counts in that stream, plus a finding for each image that fails your Docker Scout policy. Docker Scout’s metrics API reports aggregate counts rather than individual CVEs, so these findings summarize the posture of a stream. Open the stream in Docker Scout for per-image and per-CVE detail.

See the Docker Scout documentation for more information.

Endor Labs

The Endor Labs connector uses the Endor Labs REST API to sync an entire Endor Labs namespace. DefectDojo discovers each Endor project as a Record and imports that project’s findings, carrying Endor’s reachability verdict so you can prioritize vulnerabilities whose affected code is actually reachable.

Prerequisites

You will need an Endor Labs API key (a key identifier plus its secret) and the namespace you want to sync. Create the key in the Endor Labs platform under Settings > Access > API Keys; the key needs read access to the projects and findings in that namespace.

The connector authenticates by exchanging the API key and secret for a short-lived bearer token — the secret is used only for that exchange and is never stored in cleartext.

Connector Mappings

Enter https://api.endorlabs.com in the Location field. If your tenant is hosted in a different region, use that region’s API base URL instead.
Enter the Endor Labs Namespace to sync (for example your-org or your-org.team).
Enter the API Key identifier.
Enter the API Secret paired with the key.
Optionally set Traverse Child Namespaces to true to also import findings from child namespaces of the configured namespace.
Optionally set a Minimum Severity to limit which findings are imported. Findings below the selected severity are not imported.

DefectDojo creates a Record for each Endor Labs project in the namespace and imports its findings, mapping Endor severity levels to DefectDojo severities, the CVE/GHSA identifiers and CVSS score of each vulnerability, and Endor’s reachability tags. The reachability verdict (for example Reachable — vulnerable function is called or Unreachable) is surfaced as the finding’s Impact and as a tag.

For more information, see the Endor Labs REST API documentation.

Edgescan

The Edgescan connector uses the Edgescan REST API to import open vulnerabilities across your whole Edgescan account. DefectDojo enumerates every Edgescan asset and creates a Record for each one, then imports that asset’s open vulnerabilities as findings — there is no per-asset configuration.

Prerequisites

You will need an Edgescan API token. Create one from your Edgescan account under Account settings > API tokens: enter a label, click Create, and copy the generated token (it is shown only once). We recommend a dedicated account for the Connector so automated activity is easy to distinguish.

Connector Mappings

Enter your Edgescan URL in the Location field — https://live.edgescan.com for the standard hosted platform, or your tenant’s host if different.
Enter your Edgescan API token in the Secret field. It is sent as the X-API-TOKEN header.
Optionally, set a Minimum Severity to limit which findings are imported.

Each Edgescan asset becomes a Record, and each open vulnerability on that asset is imported as a finding. Severity is mapped from Edgescan’s numeric scale (1–5) to DefectDojo’s Info–Critical, and CVE references, the CWE, and a CVSS v3 vector are included where Edgescan provides them.

Escape

The Escape connector uses the Escape API to import API-security (DAST) findings. DefectDojo enumerates every organization the token can access and every application within each, creates a Record for each application that has a scan, and imports that application’s latest scan issues as findings — there is no per-application configuration.

Prerequisites

You will need an Escape API key, created in the Escape app under Settings → API keys. The key is sent in the Authorization: Key header and is never logged.

Connector Mappings

Leave the Location field blank to use https://public.escape.tech/v2, or enter your Escape API host explicitly.
Enter the Escape API key in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

DefectDojo maps each application to a Record and each scan issue to a finding: the severity comes from Escape’s rating (Critical/High/Medium/Low), the CWE is carried over, the OWASP category and HTTP method become tags, the affected URL becomes the endpoint, and the remediation guidance is included. Findings are recorded as dynamic findings and de-duplicated on Escape’s issue id.

See the Escape API documentation for more information.

Fairwinds Insights

The Fairwinds Insights connector uses the Fairwinds Insights REST API to import Kubernetes security findings across your whole organization. DefectDojo enumerates every active cluster and creates a Record for each one, then imports that cluster’s Security action items (from Polaris, Trivy, Kube-bench, OPA and the other Insights reports) as findings — there is no per-cluster configuration.

Prerequisites

You will need a Fairwinds Insights organization name and an API token. Create the token in the Insights app under Organization Settings > Tokens; a read_only token is sufficient. The token is org-scoped and is sent as a bearer token; it is never logged.

Connector Mappings

Leave the Location field blank to use https://insights.fairwinds.com, or enter your Insights host explicitly.
Enter your Insights Organization name (the slug shown in your dashboard URL).
Enter the Insights API token in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

DefectDojo maps each active cluster to a Record and each Security action item to a finding: severity comes from Fairwinds’ numeric score (mapped to DefectDojo’s Info–Critical), the Fairwinds report that produced the item (polaris, trivy, kube-bench, …) becomes a tool tag, the affected Kubernetes resource and container image are included, and any CVE identifiers are extracted. Findings are recorded as static findings and de-duplicated on the Fairwinds action-item id.

See the Fairwinds Insights API documentation for more information.

Fortify

The Fortify connector imports SAST/DAST results from Fortify (OpenText/Micro Focus), covering both editions that share the platform: SSC (Software Security Center, self-hosted) and Fortify on Demand (FoD) (SaaS). It syncs the whole account: DefectDojo discovers every application (SSC project version / FoD release) and creates a Record for each, then imports that application’s issues as findings.

Prerequisites

SSC: a FortifyToken — create one in the SSC UI under Administration → Token Management (a CIToken/UnifiedLoginToken).
FoD: an OAuth2 API key — a Client ID and Client Secret from Settings → API (with the api-tenant scope).

The token and OAuth secret are never logged.

Connector Mappings

Enter the Fortify base URL in the Location field: for SSC your server host (the connector adds /ssc/api/v1); for FoD the API host for your region, e.g. https://api.ams.fortify.com.
Set Edition to SSC or FoD.
For FoD, enter the OAuth Client ID; leave it blank for SSC.
In Token / Client Secret, enter the SSC FortifyToken or the FoD OAuth client secret.
Optionally, set a Minimum Severity to limit which findings are imported.

DefectDojo maps each Fortify application to a Record and each issue to a finding: the severity comes from Fortify’s own friority rating (Critical/High/Medium/Low), the title combines the issue category with its file and line, and the file path, line, kingdom, analyzer and engine type are carried over. Issues from static-analysis engines (SCA) are recorded as static findings and WebInspect (DAST) issues as dynamic findings; suppressed, removed and hidden issues are skipped, issues audited “Not an Issue” are marked false positive, and “Exploitable”/reviewed issues are marked verified.

See the Fortify SSC and Fortify on Demand API documentation for more information.

GitGuardian

The GitGuardian connector uses the GitGuardian REST API to import secret incidents — exposed credentials GitGuardian has detected across your monitored sources. DefectDojo creates a Record for each monitored source (repository or perimeter) that currently has open incidents, and imports each open incident as a finding.

For your security, the connector imports only incident metadata — the detector, severity, validity, status, and a link back to GitGuardian. The exposed secret value itself is never retrieved or stored by DefectDojo; follow the link in each finding to review the affected locations in GitGuardian.

Prerequisites

You will need a GitGuardian API key. We recommend a Service Account token (rather than a personal access token) so automated activity is easy to distinguish. Create it under API in the GitGuardian dashboard and grant these read scopes:

incidents:read
sources:read

Connector Mappings

Enter your GitGuardian API URL in the Location field: https://api.gitguardian.com for the SaaS platform, or your self-hosted instance’s API URL.
Enter the API key in the Secret field.

Only open incidents (status TRIGGERED or ASSIGNED) are imported; incidents you resolve or ignore in GitGuardian are automatically mitigated in DefectDojo on the next sync. A confirmed-live secret (validity valid) is imported as a verified finding.

GitHub

The GitHub connector is an Asset Connector: it enumerates the repositories your token can access and creates a DefectDojo Asset for each one, grouped into Organizations by GitHub owner (organization or user). No findings are imported.

Please note: this connector imports your repository inventory only. To import GitHub security alerts — code scanning, Dependabot, and secret scanning — as findings, use the separate GitHub Advanced Security connector below. The two are independent and can be run together.

Prerequisites

The connector authenticates with a GitHub personal access token and reads only repository metadata (name, description, URL, and owner) — it does not access your code, issues, or security alerts. It imports every repository the token’s account owns, collaborates on, or is an organization member of, so confirm the token’s account can see the repositories you want to mirror. We recommend a dedicated service account.

The token only needs read-only access to repository metadata:

A fine-grained token needs Repository permissions → Metadata: Read-only, granted to the repositories (or the whole organization) you want to import.
A classic token needs the repo scope to include private repositories (use public_repo if you only need public ones), plus read:org so organization-owned repositories resolve.

Only GitHub.com (including GitHub Enterprise Cloud) is supported. GitHub Enterprise Server is not supported by this connector at this time.

Connector Mappings

Enter https://api.github.com in the Location field.
Enter the personal access token in the Secret field.

No organization or repository list needs to be entered — DefectDojo imports every repository the token can see. Each repository becomes a Record named after the repository, grouped by its GitHub owner (organization or user). If a repository is later deleted, or the token loses access to it, its mapped Record is flagged MISSING on the next Sync rather than removed — DefectDojo never silently deletes a Product.

GitHub Advanced Security

The GitHub Advanced Security connector imports code scanning, Dependabot, and secret scanning alerts from GitHub, as three separate finding types (GitHub:CodeScanning, GitHub:Dependabot, and GitHub:SecretScanning). DefectDojo discovers every non-archived repository in the configured organization and creates a Record for each one.

Prerequisites

GitHub Advanced Security features must be enabled for the repositories you want to import. The connector authenticates with a GitHub personal access token:

In GitHub, open Settings > Developer settings > Personal access tokens and create a token owned by (or with access to) the target organization.
Grant it read access to the security alerts: a fine-grained token needs Read-only access to Code scanning alerts, Dependabot alerts, and Secret scanning alerts on the organization’s repositories; a classic token needs the repo and security_events scopes.
Confirm the token’s owner can see the repositories you intend to import — the connector only sees repositories the token can access.

Connector Mappings

Enter https://api.github.com in the Location field. For GitHub Enterprise Server, use https://<your-host>/api/v3.
Enter the organization login in the Organization field.
Enter the personal access token in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

Each non-archived repository becomes a Record, queried across the three alert families for open alerts. An alert family that is not enabled for a repository is skipped rather than reported as resolved, so disabled features do not cause false closures.

GitLab

The GitLab connector is an Asset Connector: it enumerates every project (repository) your token can access and creates a DefectDojo Asset for each one, grouped into Organizations by GitLab namespace (group or user). No findings are imported.

Prerequisites

You will need a Personal Access Token with the read_api scope. We recommend creating the token from a dedicated service account; the connector lists the projects that account is a member of.

Connector Mappings

Enter your GitLab URL in the Location field: https://gitlab.com, or the base URL of your self-hosted instance.
Enter the Personal Access Token in the Secret field.

Each project becomes a Record named after the project, grouped by its namespace. Projects that are pending deletion in GitLab (deleted by a user, but not yet purged by GitLab’s background job) are excluded automatically, so deleting a project flags its Record as MISSING on the next Sync instead of leaving behind a renamed ghost asset.

Google Cloud Security Command Center

The Google Cloud SCC connector uses the Security Command Center v2 REST API to import active security findings from your Google Cloud organization, folder, or project. DefectDojo creates a Record for each Google Cloud project that has open findings.

Prerequisites

Security Command Center must be activated on your organization (the Standard tier is free). You will then need a service account that can list findings, and a JSON key for it:

In Google Cloud, create a service account — a dedicated one for DefectDojo is recommended.
Grant it the Security Center Findings Viewer role (roles/securitycenter.findingsViewer) at the scope you want to import (organization, folder, or project).
Create a JSON key for the service account and download it.

Connector Mappings

Leave the Location field at the default https://securitycenter.googleapis.com unless you use a non-standard endpoint.
In the Parent Resource field, enter the scope to import from: organizations/{id}, folders/{id}, or projects/{id}.
Paste the full contents of the service-account JSON key file into the Service Account Key field.
Optionally, set a Minimum Severity to limit which findings are imported.

Only ACTIVE, un-muted findings are imported, so findings you deactivate or mute in SCC are automatically mitigated in DefectDojo on the next sync. Each finding’s affected GCP project becomes its Record.

Group-IB ASM

The Group-IB ASM (Attack Surface Management) connector uses the Group-IB ASM REST API to pull external attack-surface issues (findings) into DefectDojo. DefectDojo discovers each Group-IB company/tenant as a separate Record and imports that company’s issues on a scheduled, incremental basis. The asset each issue relates to (a domain, IP, or URL) is attached to the resulting finding as an Endpoint.

Prerequisites

You will need your Group-IB ASM login and an API key. We recommend creating a dedicated service account for DefectDojo so that automated activity can be distinguished from manual team actions.

To generate an API key:

Open Group-IB Attack Surface Management, click Help in the lower-left corner, and select API.
Click Generate API Key (top-right, under your username).
Enter your SSO password and click Next, then click Copy token.
Store the key in a secret manager and plan for regular rotation.

Connector Mappings

Group-IB ASM authenticates with HTTP Basic Auth, where the username is your ASM login and the password is your API key. Both values are required — the API key alone is not sufficient.

Enter https://asm.group-ib.com in the Location field. This is the same for all Group-IB ASM tenants.
Enter your ASM login (usually an email address) in the Username field.
Enter your API key in the API Key (Secret) field.
Optionally, set a Minimum Severity to limit which findings are imported. Findings below the selected severity are not imported.

DefectDojo maps each Group-IB company as a separate Record, using the company ID as the identifier. On the first Sync, DefectDojo backfills recent issue history; subsequent Syncs are incremental, pulling only issues changed since the last Sync (tracked by each issue’s most recent lastSeen timestamp).

Scoping to a single company (optional)

By default, the connector automatically discovers the companies available to your API credentials (via the ASM clients endpoint) and creates one Record per company. This is the recommended setup and requires no extra configuration.

If the clients endpoint is not available for your tenant — for example, when it is restricted to partner/MSP accounts — the connector can be scoped to one company by supplying its company ID as a company_id tool-specific field on the connector configuration. When company_id is set, DefectDojo uses that company directly instead of enumerating companies. Leave it unset to use automatic discovery.

See the Group-IB ASM REST API manual (available in-product via Help → API) for more information.

HackerOne

The HackerOne connector uses the HackerOne REST API to import reports from your bug bounty or vulnerability disclosure program. DefectDojo creates a Record for each program the token can access and imports its reports as findings.

Prerequisites

The connector uses HackerOne’s customer API, which requires an organization API token — a personal token from your user settings only works against the hacker API and will not authenticate here.

In HackerOne, go to Organization Settings > API Tokens.
Create a token and note both the identifier and the token value. Read access to the program is sufficient.

Connector Mappings

Enter https://api.hackerone.com in the Location field.
Enter the token identifier in the API Token Identifier field.
Enter the token value in the API Token field.
Optionally, set a Minimum Severity to limit which findings are imported.

Each program becomes a Record, and its reports are imported as findings with the HackerOne severity rating preserved.

Harbor

The Harbor connector uses the Harbor v2.0 REST API to import container image vulnerabilities across your whole registry. DefectDojo enumerates every Harbor project and creates a Record for each one, then walks the project’s repositories and artifacts and imports the vulnerabilities from each scanned artifact — carrying the image (repository + tag/digest) as finding context. There is no per-image configuration.

Prerequisites

You will need a Harbor account (or a robot account) with pull/read access to the projects you want to import. We recommend a dedicated robot account: in Harbor, open a project (or Administration > Robot Accounts for a system robot), create a robot with the pull permission on repositories and artifacts, and copy its full name and secret. Robot names start with robot$ by default, but the prefix is configurable per Harbor instance (some use robot_) — copy the name exactly as Harbor displays it. A regular username/password also works.

Connector Mappings

Enter your Harbor URL in the Location field — for example https://harbor.example.com. DefectDojo appends the /api/v2.0 API path automatically.
Enter the Harbor username, or a robot account name exactly as Harbor shows it (robot$<name> by default), in the Username field.
Enter the password or robot account secret in the Secret field. It is sent using HTTP Basic authentication.
Optionally, set a Minimum Severity to limit which findings are imported.

Each Harbor project becomes a Record. For every artifact that has a completed scan, its vulnerabilities are imported as findings; the affected package/version, a CVSS-derived severity, the CVE, the CWE, and a remediation (fixed version) are included where Harbor provides them. Only scanned artifacts are imported — trigger a scan in Harbor for images that have not been scanned yet.

Harbor

The Harbor connector imports container image vulnerability findings from your Harbor registry. DefectDojo creates a Record for each Harbor project.

Prerequisites

A Harbor user or robot account with pull/read access to the projects you want to import.

Connector Mappings

Enter your Harbor instance base URL in the Location field.
Enter the Harbor username in the Username field. For a robot account, enter the name exactly as Harbor shows it — robot$<name> by default (the robot prefix is configurable per instance).
Enter the password for the user, or the robot account secret, in the Password field.
Optionally, set a Minimum Severity to limit which findings are imported.

Have I Been Pwned

The Have I Been Pwned (HIBP) connector uses the HIBP REST API to report which accounts on your organization’s own domains have appeared in known data breaches. DefectDojo discovers each domain you have verified with HIBP and imports one finding per breach affecting that domain.

Prerequisites

You will need a Have I Been Pwned API key with domain search, which requires a Core subscription tier or higher. You can obtain a key from your Have I Been Pwned account.

You must also verify at least one domain on your HIBP account before any breach data is available. HIBP lets you verify a domain by DNS TXT record, meta tag, file upload, or email, under Domain search in your account. Until a domain is verified, the connector discovers no domains and imports no findings.

Connector Mappings

Enter https://haveibeenpwned.com in the Location field.
Enter your API key in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported. Findings below the selected severity will not be imported.

DefectDojo creates a separate Record for each domain you have verified with HIBP, and imports one finding per breach affecting accounts on that domain. Each finding’s severity reflects the kind of data the breach exposed, and its description lists the affected accounts on your domain so your team can act on them.

See the Have I Been Pwned API documentation for more information.

HCL AppScan

The HCL AppScan connector uses the AppScan v4 REST API to import issues from AppScan on Cloud (ASoC) or a self-hosted AppScan 360° (both share the API). It syncs the whole account: DefectDojo discovers every application and creates a Record for each, then imports that application’s issues (DAST, SAST and IAST) as findings.

Prerequisites

You will need an AppScan API key — a Key ID and Key Secret generated under your AppScan account settings (API Key). The connector exchanges them for a short-lived session token on each run; the Key ID, Key Secret and token are never logged.

Connector Mappings

Enter the AppScan console URL in the Location field: for ASoC use https://cloud.appscan.com (or https://eu.cloud.appscan.com for the EU region); for AppScan 360° use your instance host.
Set Provider to ASOC for AppScan on Cloud, or A360 for a self-hosted AppScan 360°.
Enter the API Key ID and API Key Secret.
Optionally, set a Minimum Severity to limit which findings are imported.

DefectDojo maps each AppScan application to a Record (VEP) and each issue to a finding: the title is the issue type with its domain / entity / cause-id / URL / path appended; the severity maps Informational → Info (Low/Medium/High/Critical pass through); the CWE, a labeled description, the remediation and advisory, and the host/port endpoint are carried over. Issues from static analysis are recorded as static findings and dynamic/interactive issues as dynamic findings; open issues are active and fixed/passed issues are mitigated.

See the AppScan REST API documentation for more information.

Intigriti

The Intigriti connector uses the Intigriti external company API to pull bug-bounty / pentest submissions into DefectDojo. It syncs the whole company account: DefectDojo discovers every program the token can access and creates a Record for each, then imports that program’s submissions as findings.

Prerequisites

You will need an Intigriti company API token. In the Intigriti company portal, under Company Settings > API (the company_external_api scope), generate an access token with read access to your programs and submissions. A dedicated token for DefectDojo is recommended. The token is sent as a Bearer token and is never logged.

Connector Mappings

Enter the Intigriti external company API base URL in the Location field: https://api.intigriti.com/external/company. The URL must be HTTPS.
Enter the company API token in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

DefectDojo maps each Intigriti program to a Record and each submission to a finding, keyed by the submission code. The finding severity follows Intigriti’s rating (Exceptional/Critical → Critical, then High/Medium/Low, otherwise Informational), and the submission’s lifecycle state maps to the finding’s status: open/triage submissions are active, accepted submissions are verified, and closed submissions become mitigated, a duplicate, out-of-scope, false-positive or risk-accepted according to their close reason. The finding description carries the report’s vulnerability type, affected asset, proof of concept and the researcher’s answers.

See the Intigriti API documentation for more information.

Intigriti

The Intigriti connector uses the Intigriti company API to import submissions as findings. DefectDojo creates a Record for each program.

Prerequisites

You will need an Intigriti company API access token, generated under Company Settings > API. Read access to submissions is sufficient. We recommend a dedicated service account so automated activity is easy to distinguish from manual team actions.

Connector Mappings

Enter the Intigriti API base URL in the Location field.
Enter your company API access token in the API Token field. It is sent as a Bearer token.
Optionally, set a Minimum Severity to limit which findings are imported.

Each Intigriti program becomes a Record, and its submissions are imported as findings.

Intruder

The Intruder connector uses the Intruder REST API to pull your whole account’s posture into DefectDojo. Each Intruder target is discovered as a Record (Product); each occurrence of an issue on a target becomes a Finding.

Connector Mappings

Leave the Location field as https://api.intruder.io/ (the default Intruder API server).
Enter an Intruder API access token in the Secret field.

Generate an access token in Intruder under My account > API Access Tokens (you’ll need your account password to create it, and the token is shown only once). See the Intruder API documentation for details.

Findings are derived per occurrence: severity comes from the issue severity, CVEs and CVSS from the occurrence, the location from the target/port, and a snoozed occurrence is imported as an inactive (false-positive or risk-accepted) finding.

IriusRisk

The IriusRisk connector uses an API token to pull threat modeling data from your IriusRisk instance.

Prerequisites

You will need an API token from your IriusRisk account. We recommend creating a dedicated service account for DefectDojo to clearly distinguish automated activity from manual team actions.

To generate an API token in IriusRisk:

Log in to your IriusRisk instance.
Navigate to your User Profile in the top-right menu.
Select API Token and generate a new token.

See the IriusRisk API documentation for more information.

Connector Mappings

Enter your IriusRisk instance URL in the Location URL field. For cloud-hosted instances this is typically https://{your-subdomain}.iriusrisk.com. For on-premise installations, use your instance’s base URL.
Enter your API Token in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported. Findings below the selected severity will not be imported.

JFrog Xray

The JFrog Xray connector uses the JFrog Xray REST API to fetch vulnerability data from your Artifactory repositories. DefectDojo will discover all repositories in your JFrog instance and generate vulnerability reports via Xray, importing findings on a scheduled basis.

Prerequisites

You will need an API token with access to both Artifactory and Xray APIs. We recommend creating a dedicated service account for DefectDojo. The account requires:

Read access to Artifactory repositories
Permission to generate and view Xray vulnerability reports (Apply on Watches permission in Xray, or equivalent)

Connector Mappings

Enter your JFrog instance base URL in the Location field. This should be the root URL of your JFrog instance, for example https://your-instance.jfrog.io. Do not include a trailing path — DefectDojo will construct the appropriate API paths automatically.
Enter a valid Reference Token in the Secret field. Tokens can be generated under User Management > Access Tokens in the JFrog Platform UI. You’ll need to generate a Reference Token and use that value.

Required token scopes for JFrog Xray:

All Services, as DefectDojo needs access to both access to both XRay and Artifactory services
Manage Reports + Manage Resources at a minimum.

By default, DefectDojo maps each Artifactory repository as a separate Record. Each Sync generates a complete vulnerability report per repository via Xray, so finding statuses in DefectDojo always reflect the current state of the repository.

Artifact-Level Records

Enabling the Artifact-Level Records toggle on the connection changes discovery to one level below the repository: every first-level entry under a repository root (for Docker repositories, each image; for generic repositories, each top-level file or folder) becomes its own Record. Each Sync still generates a single Xray report per repository — DefectDojo attributes each vulnerability to the artifacts it impacts, so the load on your JFrog instance does not increase.

With Artifact-Level Records enabled:

Repositories remain as Records and become parent assets: they carry no findings themselves, but when the Asset Hierarchy feature is enabled, DefectDojo automatically relates each artifact asset to its repository asset with a parent relationship. Assets can then be filtered by parent/child, and findings roll up the hierarchy.
A vulnerability that impacts several artifacts is imported into each affected artifact’s asset, so every asset shows the complete set of findings that affect it.
Hierarchy relationships created by the connector never overwrite relationships you created by hand. If an asset already has a parent you assigned, the connector leaves it alone.
The token additionally needs read access to the Artifactory storage API (included in the scopes above).

Switching an existing connection to Artifact-Level Records: the toggle can be changed at any time. On the first Sync afterward, new artifact Records appear for mapping — enable Auto Map on the connection when flipping the toggle so findings move without a gap. The repository-level assets stop receiving findings and their previously imported findings are closed on their next Sync (the same findings are re-imported under the new artifact assets, with fresh status); notes and history on the old repository-level findings stay on the repository asset. Switching back reverses this: repository Records resume carrying findings (previously closed findings re-open as they re-match), and artifact Records are marked MISSING — their assets and findings are kept but stop updating, so you can archive them at your convenience.

See the JFrog Xray REST API documentation for more information.

Jira Service Management Assets

The JSM Assets connector is an Asset Connector: it enumerates the objects in your Jira Service Management Assets (formerly Insight) workspace and creates a DefectDojo Asset for each object, grouped into Organizations by object schema. No findings are imported.

Prerequisites

Assets requires a Jira Service Management Premium or Enterprise plan. On Free or Standard plans the Assets API responds with 403 "Access to Assets API was denied", even though the rest of the site works.
The Atlassian account used must have Jira Service Management product access (an agent seat) on the site — site access alone is not enough.
Create a classic Atlassian API token at id.atlassian.com/manage-profile/security/api-tokens. We recommend a dedicated service account.

Connector Mappings

Enter your Atlassian site URL in the Location field: https://{your-site}.atlassian.net.
Enter the Atlassian account email the token belongs to in the Email field.
Enter the API token in the Secret field.

Each Assets object becomes a Record named after the object’s label, grouped by its object schema.

Kubescape

The Kubescape connector reads Kubernetes posture (misconfiguration) results produced by the Kubescape operator directly from the cluster’s Kubernetes API — no ARMO SaaS account is required. It reads the WorkloadConfigurationScan objects served by the operator’s in-cluster storage aggregated API (spdx.softwarecomposition.kubescape.io/v1beta1). Each Kubernetes namespace that has posture results is mapped to a Record (Product); each failed control on a workload becomes a Finding.

Prerequisites

The Kubescape operator must be installed in the target cluster with configuration scanning enabled (see Installing in your cluster). Confirm results exist with kubectl get workloadconfigurationscans -A.
A kubeconfig granting read access to the spdx.softwarecomposition.kubescape.io API group (list/get on workloadconfigurationscans) for the target cluster.

Connector Mappings

Enter the cluster’s API server URL (or a friendly cluster identifier) in the Location field.
Paste the kubeconfig for the target cluster in the kubeconfig field. Optionally set kube_context to select a context within it, and cluster_name to label the discovered Products.
Each namespace with posture results is discovered as a Record; map the ones you want to import to DefectDojo Products.

Findings are derived per failed control: the control name and workload identify the Finding, severity comes from the control’s score factor, the control ID becomes the vulnerability ID, and each Finding links to its control reference at https://hub.armosec.io/docs/.

Mend

The Mend connector (formerly WhiteSource) uses the Mend API to import security findings from your Mend organization. DefectDojo creates a Record for each Mend project.

Prerequisites

You will need a Mend (service) user with a User Key (a personal access token) and your Mend Organization UUID. We recommend a dedicated service account so automated activity is easy to distinguish from manual team actions. Find the Organization UUID in the Mend App under Administration > Organization UUID.

Connector Mappings

Enter your Mend API URL in the Location field. This URL is region-specific — use the API base URL for the region your Mend organization is hosted in.
Enter the login email of the Mend user in the Email field.
Enter your Mend Organization UUID in the Organization UUID field.
Enter the Mend User Key in the User Key field.
Optionally, set a Minimum Severity to limit which findings are imported.

Lacework / FortiCNAPP

The Lacework / FortiCNAPP connector uses the Lacework v2 API to import host and container vulnerabilities for your whole Lacework account.

Prerequisites

You will need a Lacework API key — an API key id and secret, created in the Lacework console under Settings → API keys. The connector exchanges these for a short-lived access token on each sync; the key id, secret and token are never logged.

Connector Mappings

Enter your Lacework account URL in the Location field — for example https://YOUR-ACCOUNT.lacework.net (a bare account name is also accepted).
Enter the API Key ID and API Secret.
Optionally, set a Minimum Severity to limit which findings are imported.

DefectDojo maps the Lacework account to a Record (the whole-account scope). Each container and host vulnerability becomes a finding: the severity comes from Lacework’s own rating, the affected package and version become the component, the fix version becomes the mitigation, and the affected image/host is recorded as tags. Container vulnerabilities are recorded as static findings (image scans) and host vulnerabilities as dynamic findings (running-host scans).

See the Lacework API documentation for more information.

Microsoft Defender

The Microsoft Defender connector imports device vulnerability findings from Microsoft Defender Vulnerability Management (MDVM) — one finding per device / software version / CVE combination, including severity, CVSS score, exploitability level and recommended security updates. DefectDojo will discover your Defender device groups and create a Record for each one; devices that aren’t assigned to any device group are collected under a synthetic Unassigned group.

Please note: this Connector is distinct from the file-based “MSDefender Parser” scan type, which imports manually exported Defender files. Choose one import path per Product to avoid duplicate findings.

Prerequisites

Your Microsoft tenant needs an active license that includes the Defender vulnerability export APIs: Defender for Endpoint Plan 2, Microsoft Defender Vulnerability Management Standalone, or MDE P1/P2 with the MDVM add-on. (The MDVM Add-on SKU on its own is not sufficient — it requires Defender for Endpoint Plan 2 underneath.)

The connector authenticates as a Microsoft Entra ID app registration using the client credentials flow. To create one:

In the Azure portal, open App registrations > New registration. Name it (for example defectdojo-connector), leave the defaults, and select Register.
On the app’s Overview page, note the Application (client) ID and Directory (tenant) ID.
Open API permissions > Add a permission > APIs my organization uses and search for WindowsDefenderATP. If it doesn’t appear, your tenant’s Defender backend hasn’t been provisioned yet: ensure the license is active, open security.microsoft.com once, and retry after a few minutes.
Choose Application permissions (not Delegated — Delegated permissions never appear in the connector’s service token), expand Vulnerability, check Vulnerability.Read.All, and select Add permissions.
Select Grant admin consent and confirm. The Status column must show a green check — without this step every API call returns a 403 error.
Open Certificates & secrets > New client secret, set an expiry, and copy the secret Value immediately (it is only shown once). The Connector stops working when the secret expires, so note the date.

Connector Mappings

Enter https://api.security.microsoft.com in the Location field.
Enter the Directory (tenant) ID in the Tenant ID field.
Enter the Application (client) ID in the Client ID field.
Enter the client secret value in the Client Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

Each Defender device group becomes a Record. Microsoft regenerates the vulnerability snapshot the connector reads roughly every 6 hours, and newly onboarded devices can take up to ~24 hours to produce their first vulnerability data — a brand-new tenant will legitimately Sync zero findings until devices are onboarded and assessed. License activation itself can also take ~20 minutes or more to reach the API (“No active license found” errors during that window resolve on their own).

Microsoft Defender for Cloud

The Microsoft Defender for Cloud connector imports vulnerability findings from Microsoft Defender Vulnerability Management (MDVM) as surfaced by Defender for Cloud — both server findings (Azure VM operating-system and installed-software CVEs) and container-registry findings (container image CVEs), including severity, CVSS score, the affected package or image, and remediation. DefectDojo discovers the Azure subscriptions your service principal can read and creates a Record for each enabled subscription.

Please note: this Connector is distinct from the Microsoft Defender connector, which imports device findings from the Defender for Endpoint API. Defender for Cloud is an Azure product with a different API surface (Azure Resource Manager / Resource Graph) and permission model (Azure RBAC). Run whichever matches where your findings live — or both, if you use both products.

Prerequisites

You need one or more Azure subscriptions with Microsoft Defender for Cloud enabled, with the relevant Defender plans turned on for the resources you want scanned (under Microsoft Defender for Cloud > Environment settings, then select your subscription):

Defender for Servers (Plan 2) — Azure VM operating-system and software CVE findings (agentless vulnerability scanning).
Defender for Containers — container-registry image CVE findings.

SQL vulnerability-assessment and configuration/posture findings are intentionally not imported — this connector imports CVE vulnerabilities only.

The connector authenticates as a Microsoft Entra ID app registration using the client credentials flow:

In the Azure portal, open App registrations > New registration. Name it (for example defectdojo-connector), leave the defaults, and select Register.
On the app’s Overview page, note the Application (client) ID and Directory (tenant) ID.
Open Certificates & secrets > New client secret, set an expiry, and copy the secret Value immediately (it is shown only once). The Connector stops working when the secret expires, so note the date.
Grant the app read access to each subscription you want to import: open Subscriptions, select your subscription, then Access control (IAM) > Add > Add role assignment. Select the Security Reader role (or Reader), and on the Members tab assign it to the app you created — search for it by the app’s name or object ID, as the picker does not match the client ID. Repeat for every subscription.

Unlike the device-based Microsoft Defender connector, no API permissions or admin consent are required: Defender for Cloud access is governed entirely by the Azure RBAC role assignment above.

Connector Mappings

Enter https://management.azure.com in the Location field. (For sovereign clouds, use the matching ARM endpoint, for example https://management.usgovcloudapi.net.)
Enter the Directory (tenant) ID in the Tenant ID field.
Enter the Application (client) ID in the Client ID field.
Enter the client secret value in the Client Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

Each enabled Azure subscription becomes a Record. Findings are read through Azure Resource Graph, so they surface promptly once Defender for Cloud has scanned your resources — but the scans themselves run on Microsoft’s schedule: container-registry images are usually scanned within an hour of being pushed, while a VM’s first agentless vulnerability scan can take several hours. A newly enabled subscription will legitimately Sync zero findings until its resources have been scanned.

MobSF

The MobSF connector uses the Mobile Security Framework (MobSF) REST API to import mobile application (APK/IPA) static-analysis results. DefectDojo discovers every app that has been scanned on your MobSF instance and creates a Record for each one, then imports that app’s static-analysis findings.

Prerequisites

You will need your MobSF REST API key. Find it on the MobSF home page under API (also shown in the MobSF docs as the Authorization value). The key is sent on every request and is never logged.

Connector Mappings

Enter your MobSF base URL in the Location field (for example https://mobsf.example.com).
In the Secret field, enter the MobSF REST API key.
Optionally, set a Minimum Severity to limit which findings are imported.

DefectDojo maps each scanned app to a Record and imports its findings from the MobSF JSON report across several sections — application permissions, code analysis, the signing certificate, the Android manifest, Android API usage and binary analysis. Each finding is tagged with CWE 919 (mobile), and its severity comes from MobSF’s own rating (high, warning, info, secure/good) — a dangerous permission is treated as High. Findings are recorded as static findings and de-duplicated on the scan, section, title, severity and file path.

See the MobSF REST API documentation for more information.

NeuVector

The NeuVector connector uses the NeuVector controller REST API to import container image vulnerability scans. DefectDojo discovers every image NeuVector has scanned and creates a Record for each, then imports that image’s scan report as findings.

Prerequisites

You will need a NeuVector username and password for a controller account with permission to read scan results. The connector logs in with these credentials to obtain a session token; the password and token are never logged.

Connector Mappings

Enter your NeuVector controller URL in the Location field, including the REST API port — for example https://neuvector.example.com:10443.
Enter the controller Username and Password.
If your controller uses a self-signed certificate, set Skip TLS Verification to true.
Optionally, set a Minimum Severity to limit which findings are imported.

DefectDojo maps each scanned image to a Record and each CVE in its scan report to a finding. The severity comes from NeuVector’s own rating, and the affected package and version, CVSSv3 score and vector, fix version (as mitigation) and reference link are carried over. Findings are de-duplicated on the image, CVE, package, version and severity.

See the NeuVector API documentation for more information.

Nuclei (ProjectDiscovery Cloud)

The Nuclei connector uses the ProjectDiscovery Cloud Platform (PDCP) REST API to pull nuclei scan results from your PDCP account. DefectDojo discovers every scan in the account and creates a separate Record for each scan.

Prerequisites

You will need a ProjectDiscovery Cloud API key. We recommend creating a dedicated service account for DefectDojo to clearly distinguish automated activity from manual team actions. Generate a key from Settings > API Key in the ProjectDiscovery Cloud UI (cloud.projectdiscovery.io). Results reach PDCP either from hosted scans or from the nuclei CLI run with -dashboard.

Connector Mappings

Enter the PDCP API base URL in the Location field: https://api.projectdiscovery.io.
Enter your API key in the Secret field.
Optionally, enter a Team ID to scope the sync to a team workspace (found under Settings > Team). When left blank, DefectDojo syncs your personal workspace.
Optionally, set a Minimum Severity to limit which findings are imported.

DefectDojo maps each PDCP scan as a separate Record and imports that scan’s findings across every severity, including informational.

OpenVAS / Greenbone

The OpenVAS / Greenbone connector imports network vulnerability findings from a Greenbone (Greenbone Community Edition or Greenbone Enterprise) instance. It talks to gvmd over GMP (Greenbone Management Protocol) — an XML protocol over a TLS socket, not HTTP — and syncs the whole instance: it enumerates scan tasks and creates a DefectDojo product for each, importing the results of each task’s latest report.

Prerequisites

A Greenbone GMP user (username + password) and network access to gvmd’s GMP TLS port (default 9390). The Greenbone Community Edition compose stack fronts gvmd via a unix socket, so to reach it from a networked connector you either run the connector where it can reach the socket or expose the GMP TLS port (for example a socat TLS bridge to gvmd.sock).

Connector Mappings

Enter the gvmd host in the Location field (host or host:port).
Enter the GMP Username and Password.
Optionally set the GMP Port (defaults to 9390).
For gvmd’s default self-signed certificate, either provide a CA Certificate (PEM) to verify against, or set Skip TLS Verification to true.
Optionally, set a Minimum Severity to limit which findings are imported.

Each Greenbone task becomes a Record. Findings come from the task’s latest finished report — one per <result>. Severity is taken from the result’s threat level (Greenbone’s Log/Debug informational levels map to Info), with the numeric CVSS score recorded; CVE references become vulnerability ids, the NVT solution becomes the mitigation, and each result’s host/port becomes an endpoint.

Probely

This connector uses the Probely REST API to fetch data.

Connector Mappings

Enter the appropriate API server address in the Location field. (either https://api.us.probely.com/ or https://api.eu.probely.com/ )
Enter a valid API key in the Secret field.

You can find an API key under the User > API Keys menu in Probely.
See Probely documentation for more info.

Prowler

The Prowler connector uses the Prowler App REST API to import cloud security posture (CSPM) findings from a self-hosted Prowler App instance. DefectDojo discovers each Prowler provider (cloud account) as a Record and imports the FAIL findings of that provider’s latest completed scan.

Prerequisites

You will need a running, self-hosted Prowler App instance and either a user email + password (for JWT authentication) or a Prowler App API key. Findings only appear once you have connected a cloud account (AWS, GCP, Azure, Kubernetes, …) in Prowler App and run a scan.

Connector Mappings

Enter your Prowler App URL in the Location field (for example https://prowler.your-company.com).
For JWT authentication, enter the Prowler App user Email and Password. Alternatively, leave those blank and enter a Prowler App API Key. If both are provided, the email/password (JWT) is used.
Optionally set a Minimum Severity to limit which findings are imported. Findings below the selected severity are not imported.

DefectDojo creates a Record for each Prowler provider and imports the FAIL findings of its latest completed scan, mapping Prowler severities to DefectDojo severities, the affected cloud resource (ARN/resource id) as the component, and the check’s remediation and risk into the finding. Muted findings are skipped. Cloud account, region, and service are attached as tags.

For more information, see the Prowler App API documentation.

Qualys

The Qualys connector imports VMDR host vulnerability detections — each joined with its Qualys KnowledgeBase (QID) metadata — from the Qualys Cloud Platform. DefectDojo creates a Record for each Qualys host in your subscription.

Prerequisites

A Qualys user account with VMDR API access, and your subscription’s API server (platform) URL — this differs per subscription. Find it in the Qualys UI under Help > About, or on the Qualys Platform Identification page (for example https://qualysapi.qualys.com for US Platform 1, or https://qualysapi.qg2.apps.qualys.com for US Platform 2).

Connector Mappings

Enter your Qualys API server URL in the Location field (for example https://qualysapi.qualys.com).
Enter the Qualys API username in the Username field.
Enter the Qualys API password in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

Each Qualys host becomes a Record. Detections Qualys has marked Fixed are excluded, so reimport closes remediated findings.

Quay

The Quay connector uses the Project Quay REST API to discover container repositories and import the vulnerability reports produced by Quay’s built-in Clair scanner. DefectDojo creates a Record for each Quay repository and, on each Sync, reads the Clair security report of every active tag’s image manifest.

Prerequisites

Security scanning (Clair) must be enabled on your Quay instance, and you will need a Quay OAuth 2 access token:

In Quay, create (or open) an Organization, go to Applications, create an OAuth application, then Generate Token with at least the Read repositories scope. A dedicated application for DefectDojo is recommended.
The token is sent as a Bearer token on every request and is never logged.

Connector Mappings

Enter your Quay base URL in the Location field, for example https://quay.io or your self-hosted https://quay.example.com. The URL must be HTTPS; do not include a trailing API path — DefectDojo constructs the API paths automatically.
Enter the OAuth access token in the Secret field.
Optionally, set a Namespace to restrict discovery to a single Quay organization or user. Leave blank to discover every repository the token can read.
Optionally, set a Minimum Severity to limit which findings are imported.

DefectDojo maps each Quay repository to a Record. For each repository it lists the active tags, deduplicates them to their unique image manifests (a manifest shared by multiple tags is scanned once), and reads each manifest’s Clair report. Manifests Clair has not finished scanning (for example a multi-architecture manifest list, or an image still queued) are skipped until a later Sync. Each Clair vulnerability becomes a finding — the affected package is the component, the fixed version becomes the mitigation, and Clair’s Negligible/Unknown severities are recorded as Informational.

See the Project Quay API documentation and the Clair documentation for more information.

Rapid7 InsightAppSec

The Rapid7 InsightAppSec connector imports DAST vulnerability findings from the InsightAppSec cloud platform, enriched with attack-module metadata (for example SQL Injection), CVSS scores, and the evidence collected by the scan. DefectDojo creates a Record for each InsightAppSec app.

Please note: this Connector is distinct from the Rapid7 InsightVM connector below — InsightAppSec is Rapid7’s cloud DAST product on the Insight platform, while InsightVM findings come from your own Security Console.

Prerequisites

An Insight platform account with InsightAppSec, and a platform API key: in the Rapid7 Insight platform, open the settings (gear) menu > API Keys and generate a User Key (any role) or an Organization Key (platform admins). Copy the key when it is shown — it is displayed only once.

You also need your platform region, visible in your Insight URL (for example us, us2, us3, eu, ca, au, or ap).

Connector Mappings

Enter your regional API endpoint in the Location field — for example https://us.api.insight.rapid7.com (replace us with your region).
Enter the Insight platform API key in the API Key field.
Optionally, set a Minimum Severity to limit which findings are imported.

Each InsightAppSec app becomes a Record. Only open vulnerabilities (Unreviewed or Verified) are imported — findings Rapid7 has marked Remediated, a False Positive, Ignored, or Duplicate are excluded, so reimport closes them in DefectDojo. Severities map directly (SAFE and INFORMATIONAL import as Info).

Rapid7 InsightVM

The Rapid7 InsightVM connector imports asset vulnerability findings from your InsightVM Security Console (API v3), enriched with the console’s global vulnerability catalog. DefectDojo creates a Record for each InsightVM site.

Prerequisites

Network access from DefectDojo to your Security Console, and a console user account — its login is used for HTTP Basic authentication. The console API is served on port 3780 by default.

Connector Mappings

Enter your Security Console URL, including the port, in the Location field — for example https://console.example.com:3780.
Enter the console username in the Username field.
Enter the console password in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

Each InsightVM site becomes a Record; the connector walks the site’s assets and imports their vulnerable findings.

runZero

The runZero connector uses the runZero Export API to sync your whole organization’s asset inventory into DefectDojo. It is primarily an asset connector: DefectDojo discovers every asset and creates a Record for each, grouped into a Product Type by its runZero site. It can optionally also import runZero’s vulnerabilities as findings.

Prerequisites

You will need an organization Export Token from runZero (Account → API), which is prefixed XT. The token is organization-scoped (the organization is encoded in the token), read-only, and is sent as a Bearer token — it is never logged. A community/starter tier is available.

Connector Mappings

Enter your runZero console URL in the Location field, for example https://console.runzero.com. The URL must be HTTPS.
Enter the Export Token in the Secret field.
Optionally set Import Vulnerabilities to true to also import runZero vulnerabilities as findings; leave it blank to sync assets only.
Optionally, set a Minimum Severity to limit which vulnerability findings are imported (applies only when vulnerabilities are imported).

DefectDojo maps each runZero asset to a Record (VEP): the display name comes from the asset’s name or address, and its site, type, OS, addresses and tags are attached as attributes; the asset’s site becomes its Product Type. Assets are synced with a full export that DefectDojo reconciles (adds/removes). When Import Vulnerabilities is enabled, each runZero vulnerability becomes a finding on its asset — mapping the severity, CVSS score, CVE, affected service (protocol://address:port) endpoint and the remediation.

See the runZero API documentation for more information.

Semgrep

This connector uses the Semgrep REST API to fetch data.

Connector Mappings

Enter https://semgrep.dev/api/v1/ in the Location field.

Enter a valid API key in the Secret field. You can find this on the Tokens page:

“Settings” in the left navbar > Tokens > Create new token (https://semgrep.dev/orgs/-/settings/tokens)

See Semgrep documentation for more info.

ServiceNow CMDB

The ServiceNow CMDB connector is an Asset Connector: instead of importing findings, it reads Configuration Items (CIs) from your ServiceNow Configuration Management Database and creates a DefectDojo Asset for each CI, grouped into Organizations by CI class. No findings are imported.

Prerequisites

You will need a ServiceNow instance and an account that can read the CMDB tables over the ServiceNow Table API. We recommend a dedicated, read-only service account for DefectDojo. The account needs read access to the cmdb_ci tables you want to import.

Connector Mappings

Enter your ServiceNow instance URL in the Location field: https://{your-instance}.service-now.com.
Select or create a ServiceNow Tool Configuration holding the instance credentials (the ServiceNow username and password).

Each Configuration Item becomes a Record named after the CI, grouped by its CI class (for example, application, server, or business service). Discovery and Sync reconcile the CI list: new CIs appear as NEW Records, and a CI removed from the CMDB is flagged MISSING on the next Sync so your team can triage it. DefectDojo never silently deletes a Product.

Shodan

The Shodan connector uses the Shodan REST API to import the vulnerabilities (CVEs) Shodan has observed on your internet-exposed hosts. You provide a Shodan search query that scopes the import to your own assets; DefectDojo creates a Record for each matching host and imports its CVEs as findings.

Prerequisites

You will need a Shodan API key, found on your Shodan Account page. Host search with vulnerability data requires a Shodan membership or a paid API plan — the free tier cannot page through search results.

Connector Mappings

Enter https://api.shodan.io in the Location field.
Enter your Shodan API key in the API Key field.
In the Search Query field, enter a Shodan query that scopes the import to your organization’s assets — for example hostname:example.com, net:203.0.113.0/24, or org:"Example Inc". Only hosts matching this query are imported, so keep it scoped to infrastructure you own.
Optionally, set a Minimum Severity to limit which findings are imported.

Each matching host becomes a Record, and each CVE Shodan detected on that host’s exposed services is imported as a finding — severity is derived from the CVSS score, with EPSS and CISA KEV context included where available. Each page of search results consumes one Shodan query credit.

SonarQube

The SonarQube Connector can fetch data from either a SonarCloud account or from a local SonarQube instance.

For SonarCloud users:

Enter https://sonarcloud.io/ in the Location field.
Enter a valid API key in the Secret field.

For SonarQube (on-premise) users:

Enter the base url of your SonarQube instance in the Location field: for example https://my.sonarqube.com/
Enter a valid API key in the Secret field. This will need to be a User API Token Type.

The token will need to have access to Projects, Vulnerabilities and Hotspots within Sonar.

API tokens can be found and generated via My Account -> Security -> Generate Token in the SonarQube app. For more information, see SonarQube documentation.

Snyk

The Snyk connector uses the Snyk REST API to fetch data.

Connector Mappings

Enter https://api.snyk.io/rest or https://api.eu.snyk.io/rest (for a regional EU deployment) in the Location field.
Enter a valid API key in the Secret field. API Tokens are found on a user’s Account Settings page in Snyk.

See the Snyk API documentation for more info.

Socket

The Socket connector uses the Socket.dev API to import software supply-chain findings — Socket’s alerts on your dependencies (malware, typosquats, install scripts, known vulnerabilities and 70+ other categories). DefectDojo discovers every repository across the organizations your token can access and creates a Record for each, then imports the alerts from that repository’s latest full scan.

Prerequisites

You will need a Socket API token — an organization token created in the Socket dashboard under Settings → API Tokens (with the repo:list and full-scan read scopes). The token is sent as a bearer token and is never logged.

Connector Mappings

Leave the Location field blank to use https://api.socket.dev/v0, or enter it explicitly.
Enter the Socket API token in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

DefectDojo maps each repository to a Record and imports the alerts from its most recent full scan. Each alert becomes a finding: the severity comes from Socket’s own rating (low, medium, high, critical), the affected package becomes the component and a PURL, the alert category (supply-chain risk, quality, maintenance, vulnerability, license) is recorded as tags, and the alert details are carried into the description. Findings are recorded as static findings and de-duplicated on Socket’s alert key.

See the Socket API documentation for more information.

Sonatype IQ

The Sonatype IQ connector uses the Sonatype IQ Server (Nexus Lifecycle) REST API to import open-source component vulnerabilities. It enumerates every application in your IQ organization and, for each one, imports the component vulnerabilities from that application’s latest report at the lifecycle stage you configure. DefectDojo creates a Record for each application automatically — there is no per-application configuration.

Prerequisites

You will need a Sonatype IQ user account with the View IQ Elements permission on the applications you want to import. Sonatype recommends authenticating with a user token (generated under My Profile > User Token in IQ Server) rather than a password; the token’s two parts map to the Username and User Token fields below. The connector works with both self-hosted IQ Server and Sonatype-hosted (SaaS) instances.

Connector Mappings

In the Location field, enter your IQ Server base URL — for a self-hosted server, https://iq.example.com; for a Sonatype-hosted instance, https://<tenant>.sonatype.app/platform.
Enter the IQ user (or the user-code part of your user token) in the Username field.
Enter the IQ user token (or password) in the User Token field.
Optionally, set a Stage to choose which lifecycle stage’s report is imported per application (build, stage-release, release, and so on). Leave it blank to use build.
Optionally, set a Minimum Severity to limit which findings are imported.

Each application becomes a Record, and each security issue in that application’s latest report for the selected stage is imported as a finding. Severity is derived from the issue’s numeric score, and CVE references, CWE, the CVSS vector, and the affected component’s package URL (PURL) are included where available.

Sysdig Secure

The Sysdig Secure connector imports container / CNAPP vulnerability findings from Sysdig Secure’s vulnerability management API. It syncs the whole account across the configured scope(s) and creates a DefectDojo product for each scanned asset grouping.

Prerequisites

A Sysdig Secure API token: in Sysdig Secure, go to Settings > Sysdig Secure API Token and copy the token. You also need your Sysdig region URL (for example https://us2.app.sysdig.com, https://eu1.app.sysdig.com, or your on-premises host).

Connector Mappings

Enter your Sysdig region/base URL in the Location field.
Enter the API token in the Secret field.
Optionally set Scopes — a comma-separated list of runtime, registry, and/or pipeline (leave blank for runtime, the deployed-workload scope).
Optionally set Runtime Product Grouping — how runtime results map to products: cluster, namespace, workload, or image (leave blank for namespace). Registry and pipeline results always group by image repository.
Optionally, set a Minimum Severity to limit which findings are imported.

Each asset grouping becomes a Record. For each scan result the connector imports every vulnerable package as a finding. Runtime findings (deployed workloads) are recorded as dynamic findings and tagged with their Kubernetes cluster / namespace / workload / container context; registry and pipeline findings are recorded as static image-scan findings. Sysdig’s NEGLIGIBLE severity maps to Info.

Tenable

The Tenable connector uses the Tenable.io REST API to fetch data. Scans are pulled from the Tenable VM /scans endpoint.

On-premise Tenable Connectors are not available at this time.

Connector Mappings

Enter https://cloud.tenable.com in the Location field.
Enter a valid API key in the Secret field.

See Tenable’s API Documentation for more info.

Veracode

The Veracode connector imports application findings from the Veracode platform, split by scan type into SAST, DAST, SCA, and Manual finding types. DefectDojo creates a Record for each Veracode application.

Prerequisites

Generate a Veracode API credential for an account that can see the applications you want to import: in the Veracode Platform, open your account menu > API Credentials and select Generate API Credentials (see Managing Veracode API credentials). Copy both the API ID and the API Secret Key — the secret is shown only once.

Connector Mappings

Enter the Veracode API base URL in the Location field: https://api.veracode.com (commercial region), https://api.veracode.eu (European region), or https://api.veracode.us (US federal region).
Enter the API ID in the API ID field.
Enter the API secret key in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

Each Veracode application becomes a Record. Only open findings are imported, so reimport closes findings Veracode reports as resolved.

Wazuh

The Wazuh connector uses the Wazuh Indexer (OpenSearch) to fetch vulnerability findings. Wazuh 4.8 and later store detected CVEs in the Indexer rather than the Wazuh server API, so this connector reads them directly from the wazuh-states-vulnerabilities-* index.

DefectDojo creates a Record for each Wazuh agent (endpoint) and imports that agent’s detected CVEs as findings on a scheduled basis.

Prerequisites

You will need:

The base URL of your Wazuh Indexer, including the port (the Indexer listens on port 9200 by default). DefectDojo connects to the Indexer directly, so this endpoint must be reachable from DefectDojo. For self-managed deployments this is the host running the Wazuh Indexer. For Wazuh Cloud, use the Indexer endpoint shown in your Wazuh Cloud console, which is separate from the Wazuh dashboard URL.
An Indexer user and password with read access to the wazuh-states-vulnerabilities-* index. We recommend creating a dedicated user for DefectDojo.

Vulnerability detection must be enabled in Wazuh so that the vulnerability-state index is populated. See the Wazuh vulnerability detection documentation for more information.

Connector Mappings

Enter your Wazuh Indexer base URL in the Location field, including the scheme and port, for example https://your-indexer.example.com:9200. Do not include a trailing path. DefectDojo constructs the search paths automatically.
Enter the Indexer username in the Username field.
Enter the Indexer password in the Password field.
Optionally, set a Minimum Severity to limit which findings are imported. Findings below the selected severity will not be imported.

Wiz

Using the Wiz connector requires you to create a service account: see the Wiz documentation for more info. You will need a Wiz account to access the documentation.

Connector Mappings

Enter your Wiz Client ID in the Client ID field.
Enter the Wiz Client Secret in the Secret field.

YesWeHack

The YesWeHack connector uses the YesWeHack REST API to import reports from your bug bounty and vulnerability disclosure programs. DefectDojo creates a Record for each program your token can access and imports its reports as findings.

Prerequisites

You will need a YesWeHack Personal Access Token (PAT). Read access to your programs is sufficient. Some accounts require TOTP/MFA when creating a token; once created, the token value itself is what the connector uses.

In YesWeHack, open your account settings and go to API / Personal Access Tokens.
Create a token and copy its value. It is only shown once.

Connector Mappings

Enter https://api.yeswehack.com/ in the Location field.
Enter your Personal Access Token in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported. Findings below the selected severity will not be imported.

DefectDojo creates a separate Record for each program your token can access, and imports each report as a finding. The finding’s severity is taken from the report’s CVSS rating (falling back to the triage priority), and its status reflects the report’s workflow state — for example, resolved reports are imported as mitigated, and reports marked invalid or out of scope are imported as inactive.

YesWeHack

The YesWeHack connector uses the YesWeHack API to import bug bounty reports as findings. DefectDojo creates a Record for each program.

Prerequisites

You will need a YesWeHack API token. We recommend a dedicated service account so automated activity is easy to distinguish from manual team actions.

Connector Mappings

Enter the YesWeHack API base URL in the Location field.
Enter your API token in the Secret field.
Optionally, set a Minimum Severity to limit which findings are imported.

Each YesWeHack program becomes a Record, and its reports are imported as findings.

Managing Records

Tool-Specific Connector Setup

Asset Connectors

Supported Connectors

Acunetix 360#

Prerequisites#

Connector Mappings#

Akamai API Security#

Prerequisites#

Connector Mappings#

Anchore#

Connector Mappings#

AWS Security Hub#

Prerequisites#

Connector Mappings#

Azure DevOps#

Prerequisites#

Connector Mappings#

Backstage#

What gets mapped#

Prerequisites#

Connector Mappings#

Limitations (v1)#

Black Duck#

Prerequisites#

Connector Mappings#

Bitbucket#

Prerequisites#

Connector Mappings#

Black Duck#

Connector Mappings#

Bugcrowd#

Prerequisites#

Connector Mappings#

Bright Security#

Prerequisites#

Connector Mappings#

BurpSuite#

Prerequisites#

Connector Mappings#

Censys#

Prerequisites#

Connector Mappings#

Checkmarx ONE#

Connector Mappings#

Branch handling#

Cloudflare#

Prerequisites#

Connector Mappings#

Cobalt.io#

Prerequisites#

Connector Mappings#

Contrast#

Prerequisites#

Connector Mappings#

Coverity#

Connector Mappings#

CrowdStrike Falcon#

Prerequisites#

Connector Mappings#

Deepfence ThreatMapper#

Prerequisites#

Connector Mappings#

Dependency-Track#

Docker Scout#

Prerequisites#

Connector Mappings#

Endor Labs#

Prerequisites#

Connector Mappings#

Edgescan#

Prerequisites#

Connector Mappings#

Escape#

Prerequisites#

Connector Mappings#

Fairwinds Insights#

Prerequisites#

Connector Mappings#

Fortify#

Prerequisites#

Acunetix 360

Prerequisites

Connector Mappings

Akamai API Security

Prerequisites

Connector Mappings

Anchore

Connector Mappings

AWS Security Hub

Prerequisites

Connector Mappings

Azure DevOps

Prerequisites

Connector Mappings

Backstage

What gets mapped

Prerequisites

Connector Mappings

Limitations (v1)

Black Duck

Prerequisites

Connector Mappings

Bitbucket

Prerequisites

Connector Mappings

Black Duck

Connector Mappings

Bugcrowd

Prerequisites

Connector Mappings

Bright Security

Prerequisites

Connector Mappings

BurpSuite

Prerequisites

Connector Mappings

Censys

Prerequisites

Connector Mappings

Checkmarx ONE

Connector Mappings

Branch handling

Cloudflare

Prerequisites

Connector Mappings

Cobalt.io

Prerequisites

Connector Mappings

Contrast

Prerequisites

Connector Mappings

Coverity

Connector Mappings

CrowdStrike Falcon

Prerequisites

Connector Mappings

Deepfence ThreatMapper

Prerequisites

Connector Mappings

Dependency-Track

Docker Scout

Prerequisites

Connector Mappings

Endor Labs

Prerequisites

Connector Mappings

Edgescan

Prerequisites

Connector Mappings

Escape

Prerequisites

Connector Mappings

Fairwinds Insights

Prerequisites

Connector Mappings

Fortify

Prerequisites

Connector Mappings

GitGuardian

Prerequisites