Quark-Engine

Import Quark-Engine reports in JSON format. Quark-Engine scores Android applications by detecting behaviours (“crimes”) such as sending device location over SMS, rather than by matching known vulnerabilities.

Generate a report with:

quark -a sample.apk -s -o quark-report.json

Severity Mapping#

Quark-Engine assigns no severity. Each detected behaviour carries a confidence expressing how many of Quark’s five detection stages matched — requested permission, native API call, API combination, calling sequence, and shared register — in 20% increments. A confidence of 100% means every required API was used and a data flow between them was confirmed; 80% means the APIs were present but no data flow was found.

DefectDojo derives severity from that confidence:

The report’s own threat_level and total_score describe the APK as a whole rather than any single behaviour, so they are not mapped onto individual Findings.

Sample Scan Data#

Sample Quark-Engine scans can be found here.

Default Deduplication Hashcode Fields#

By default, DefectDojo identifies duplicate Findings using these hashcode fields:

• title
• component_name
• vuln_id_from_tool