Prospector

Import Prospector reports in JSON format. Prospector runs several Python analysis tools — pylint, pyflakes, dodgy, bandit and others — and reports their messages under a common shape.

Generate a report with:

prospector --output-format json > prospector.json

Severity Mapping#

Prospector is a meta-tool, and its messages range from style to security. DefectDojo weights by the tool that raised each message so a real security finding is not lost among linter noise:

The originating tool and its check code are recorded on every Finding, so results can be filtered by source after import.

Sample Scan Data#

Sample Prospector scans can be found here.

Default Deduplication Hashcode Fields#

By default, DefectDojo identifies duplicate Findings using these hashcode fields:

• vuln_id_from_tool
• file_path
• line