Generic Findings Import

Generic Findings Import can be used to import any report in CSV or JSON format.

Supported Attributes (CSV)#

• Date: Date of the finding in mm/dd/yyyy format.
• Title: Title of the finding
• CweId: Cwe identifier, must be an integer value.
• Url: Url associated with the finding.
• Severity: Severity of the finding. Must be one of Info, Low, Medium, High, or Critical.
• Description: Description of the finding. Can be multiple lines if enclosed in double quotes.
• Mitigation: Possible Mitigations for the finding. Can be multiple lines if enclosed in double quotes.
• Impact: Detailed impact of the finding. Can be multiple lines if enclosed in double quotes.
• References: References associated with the finding. Can be multiple lines if enclosed in double quotes.
• Active: Indicator if the finding is active. Must be empty, TRUE or FALSE
• Verified: Indicator if the finding has been verified. Must be empty, TRUE, or FALSE
• FalsePositive: Indicator if the finding is a false positive. Must be TRUE, or FALSE.
• Duplicate:Indicator if the finding is a duplicate. Must be TRUE, or FALSE
• IsMitigated: Indicator if the finding is mitigated. Must be TRUE, or FALSE
• MitigatedDate: Date the finding was mitigated in mm/dd/yyyy format or ISO format
• epss_score: Finding EPSS score
• epss_percentile: Finding EPSS percentile
• CVSSV3: CVSSv3 verctor of the finding
• CVSSV3_score: CVSSv3 score of the finding
• CVSSV4: CVSSv4 vector of the finding
• CVSSV4_score: CVSSv4 score of the finding
• known_exploited: Indicator if the finding is listed in Known Exploited List. Must be TRUE, or FALSE
• ransomware_used: Indicator if the finding is used in Ransomware. Must be TRUE, or FALSE
• fix_available: Indicator if fix available for the finding. Must be TRUE, or FALSE
• fix_version: Version where fix is available. String value.
• kev_date: Date the finding was added to Known Exploited Vulnerabilities list in mm/dd/yyyy format or ISO format.

The CSV expects a header row with the names of the attributes.

Date fields are parsed using dateutil.parse supporting a variety of formats such a YYYY-MM-DD or ISO-8601.

Supported Attributes (JSON)#

The list of supported fields in JSON format:

• title: Required. String
• severity: Required. One of the “Critical”, “High”, “Medium”, “Low”, “Info”
• description: Required. String
• date: Date
• cwe: Int
• cve: String
• vulnerability_ids: List of Strings
• epss_score: Float
• epss_percentile: Float
• cvssv3: String
• cvssv3_score: Float
• cvssv4: String
• cvssv4_score: Float
• mitigation: String
• impact: String
• steps_to_reproduce: String
• severity_justification: String
• references: String
• active: Bool
• verified: Bool
• false_p: Bool
• out_of_scope: Bool
• risk_accepted: Bool
• under_review: Bool
• is_mitigated: Bool
• thread_id: String
• mitigated: Date
• numerical_severity: Int
• param: String
• payload: String
• line: Int
• file_path: String
• component_name: String
• component_version: String
• static_finding: Bool
• dynamic_finding: Bool
• scanner_confidence: Int
• unique_id_from_tool: String
• vuln_id_from_tool: String
• sast_source_object: String
• sast_sink_object: String
• sast_source_line: Int
• sast_source_file_path: String
• nb_occurences: Int
• publish_date: Date
• service: String
• planned_remediation_date: Date
• planned_remediation_version: String
• effort_for_fixing: One of the “High”, “Medium”, “Low”
• tags: List of Strings
• kev_date: Date
• known_exploited: Bool
• ransomware_used: Bool
• fix_available: Bool
• fix_version: String

A numeric field may be given as a number or as a quoted number. A value that holds no number at all, such as a "N/A" placeholder for a line number the tool could not determine, is ignored and the field keeps its default.

Example JSON#

{
    "findings": [
        {
            "title": "test title with endpoints as dict",
            "description": "Some very long description with\n\n some UTF-8 chars à qu'il est beau",
            "severity": "Medium",
            "mitigation": "Some mitigation",
            "date": "2021-01-06",
            "cve": "CVE-2020-36234",
            "cwe": 261,
            "cvssv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "cvssv4": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "cvssv4_score": 7.3,
            "known_exploited": true,
            "ransomware_used": true,
            "fix_available": true,
            "fix_version": "0.0.00",
            "kev_date": "2024-05-01",
            "file_path": "src/first.cpp",
            "line": 13,
            "vulnerability_ids": ["GHSA-5mrr-rgp6-x4gr", "OSV-2021-1234"],
            "endpoints": [
                {
                    "host": "exemple.com"
                }
            ],
            "tags": [
                "security",
                "myTag"
            ],
        },
        {
            "title": "test title with endpoints as strings",
            "description": "Some very long description with\n\n some UTF-8 chars à qu'il est beau2",
            "severity": "Critical",
            "mitigation": "Some mitigation",
            "date": "2021-01-06",
            "cve": "CVE-2020-36235",
            "cwe": 287,
            "cvssv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "file_path": "src/two.cpp",
            "line": 135,
            "endpoints": [
                "http://urlfiltering.paloaltonetworks.com/test-command-and-control",
                "https://urlfiltering.paloaltonetworks.com:2345/test-pest"
            ]
        },
        {
            "title": "test title",
            "description": "Some very long description with\n\n some UTF-8 chars à qu'il est beau2",
            "severity": "Critical",
            "mitigation": "Some mitigation",
            "date": "2021-01-06",
            "cve": "CVE-2020-36236",
            "cwe": 287,
            "cvssv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "file_path": "src/threeeeeeeeee.cpp",
            "line": 1353
        },
        {
            "title": "test title mitigated",
            "description": "Some very long description with\n\n some UTF-8 chars à qu'il est beau2",
            "severity": "Critical",
            "mitigation": "Some mitigation",
            "date": "2021-01-06",
            "cve": "CVE-2020-36236",
            "cwe": 287,
            "cvssv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "file_path": "src/threeeeeeeeee.cpp",
            "line": 1353,
            "is_mitigated": true,
            "mitigated": "2021-01-16"
        },
        {
            "title": "test title mitigated ISO",
            "description": "Some very long description with\n\n some UTF-8 chars à qu'il est beau2",
            "severity": "Critical",
            "mitigation": "Some mitigation",
            "date": "2024-01-04T11:02:11Z",
            "cve": "CVE-2020-36236",
            "cwe": 287,
            "cvssv3": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "file_path": "src/threeeeeeeeee.cpp",
            "line": 1353,
            "is_mitigated": true,
            "mitigated": "2024-01-24T11:02:11Z"
        }
    ]
}

This parser supports an attributes that accept files as Base64 strings. These files are attached to the respective findings.

Example:

{
    "name": "My wonderful report",
    "findings": [
        {
            "title": "Vuln with image",
            "description": "Some very long description",
            "severity": "Medium",
            "files": [
                {
                    "title": "Screenshot from 2017-04-10 16-54-19.png",
                    "data": "iVBORw0KGgoAAAANSUhEUgAABWgAAAK0CAIAAAARSkPJAAAAA3N<...>TkSuQmCC"
                }
            ]
        }
    ]
}

This parser supports an attribute name and type to be able to define TestType. Based on this, you can define custom HASHCODE_FIELDS or DEDUPLICATION_ALGORITHM in the settings.

Example:

{
    "name": "My wonderful report",
    "type": "My custom Test type",
    "findings": [
    ]
}

The resulting Test Type name is derived from the type field: when type is omitted (or equals the scan type) the Test Type is Generic Findings Import; when type is provided it becomes {type} Scan (Generic Findings Import) (for the example above, My custom Test type Scan (Generic Findings Import)). A type that already ends with the (Generic Findings Import) suffix is used verbatim, so the suffix is never doubled.

Sample Scan Data#

Sample Generic Findings Import scans can be found here.

Default Deduplication Hashcode Fields#

By default, DefectDojo identifies duplicate Findings using these hashcode fields:

• title
• cwe
• line
• file path
• description