You can use webhooks to import vulnerabilities discovered by DAST Essentials to vulnerability management solutions.
The importing of the scan results is available through easy integration. Once you start an engagement, you can easily import the machine-readable scan results and have them shown as findings, including CVSS scoring, vulnerability description, URL, and remediation advice, and included a link to the docs.
If you want to automate this process altogether, you can automatically use the DefectDojo API to send the scan reports to the API.
This process would need to be defined in your CI/CD to ensure this happens after every scan. Also, see the below example of importing a scan result with the API.
DefectDojo allows you to integrate with Jira, so you can easily create Jira tickets from your DefectDojo and close findings if the ticket is closed.
See the DefectDojo documentation.
If you need help with this process, contact Veracode Technical Support.
Example: Import scan results to DefectDojo
Below is an example of testing the DefectDojo API with a tool like Postman.
This example assumes your DefectDojo is running at https://defectdojo.herokuapp.com/ (demo application)
- Verb: POST
- URI: https://defectdojo.herokuapp.com/api/v2/import-scan/
- Headers tab: add the authentication header
- Key: Authorization
- Value: Token "token_value"
- Body tab
- Select form-data, select bulk edit. Example for a DAST Essentials scan:
scan_type:DAST Essentials Scan
- Body tab
- Select Key-value edit.
- Add a
fileparameter of type
file. This will trigger multi-part form data for sending the file content.
- Browse for the file to upload.
- Select Send.
Importing, collecting, and reporting on findings is similar to the above-described process for DefectDojo. If you need help with importing your results, contact Veracode Technical Support.