Integration in vulnerability management solutions
This guide will focus on the easy integration of the Crashtest Security Suite with vulnerability management solutions, such as DefectDojo or Faraday.
See below how your existing systems can be used with Crashtest Security.
DefectDojo is an Open Source application available through GitHub.
See the different usage examples for more details on the different usage types.
The importing of the scan results is available through easy integration. Once you start an engagement, you can easily import the machine-readable scan results and have them shown as findings, including CVSS scoring, vulnerability description, URL, and remediation advice, and included a link to the docs.
If you want to automate this process altogether, you can automatically use the DefectDojo API to send the scan reports to the API.
This process would need to be defined in your CI/CD to ensure this happens after every scan. Also, see the below example of importing a scan result with the API.
DefectDojo allows you to integrate with Jira, so you can easily create Jira tickets from your DefectDojo and close findings if the ticket is closed.
More documentation is available through the DefectDojo documentation website.
If you need help with this process, contact Veracode Technical Support.
Importing scan results in DefectDojo example
Below is an example of testing the DefectDojo API with a tool like Postman.
This example assumes your DefectDojo is running at https://defectdojo.herokuapp.com/ (demo application)
- Verb: POST
- URI: https://defectdojo.herokuapp.com/api/v2/import-scan/
- Headers tab: add the authentication header
- Key: Authorization
- Value: Token "token_value"
- Body tab
- Select form-data, click bulk edit. Example for a Crashtest Security scan:
scan_type:Crashtest Security Scan
- Body tab
- Click Key-value edit.
- Add a
fileparameter of type
file. This will trigger multi-part form data for sending the file content.
- Browse for the file to upload.
- Click Send.
Faraday is a vulnerability management solution developed by Infobyte. There is a free Community edition available on GitHub. For more information, see the Faraday documentation.
Importing, collecting, and reporting on findings is similar to the above-described process for DefectDojo. If you need help with importing your results, contact Veracode Technical Support.