CISA ScubaGoggles

Import CISA ScubaGoggles reports in JSON format. ScubaGoggles assesses a Google Workspace tenant against the CISA SCuBA secure configuration baselines.

Two artifacts are supported, each with its own scan type:

• ScubaGoggles Scan — the ScubaResults_*.json, holding the full pass and fail set.
• ScubaGoggles Action Plan — the ActionPlan.csv, holding only the controls that did not pass.

Run an assessment and import either:

scubagoggles gws -o output

Severity Mapping#

ScubaGoggles reports no severity. Each baseline policy carries a criticality — Shall is mandatory, Should is recommended — and a result. DefectDojo derives severity from the pair:

Baselines whose criticality ends in Not-Implemented are ones ScubaGoggles does not yet evaluate. They describe a gap in the tool rather than in the tenant, so they are not imported.

The Requirement and Details fields are rendered for the HTML report and contain markup, which is stripped before the text reaches the Finding.

Sample Scan Data#

Sample ScubaGoggles scans can be found here.

Default Deduplication Hashcode Fields#

By default, DefectDojo identifies duplicate Findings using these hashcode fields:

• vuln_id_from_tool
• component_name