Semgrep JSON Report
Import Semgrep output (–json)
Opengrep
Opengrep is a fork of Semgrep and emits the same JSON schema, so its reports import with this parser — no separate scan type is needed:
opengrep scan --config <rules.yaml> --json --json-output=opengrep.json <path>Verified against Opengrep 1.26.0: check_id, path, start.line, extra.severity and
extra.metadata.cwe are all read as they are for Semgrep, so severities and CWEs come through
unchanged. Note that Opengrep prefixes rule ids with the config path, exactly as Semgrep does, so the
finding title reflects where the rule file lives.
Sample Scan Data
Sample Semgrep JSON Report scans can be found here.
Default Deduplication Hashcode Fields
By default, DefectDojo identifies duplicate Findings using these hashcode fields:
- title
- cwe
- line
- file path
- description