vuln-defectdojo

name	vuln-defectdojo
description	Vulnerability management and findings aggregation using DefectDojo. Centralizes security findings from all SecOpsAgentKit scanners (Semgrep, Bandit, ZAP, Trivy, Grype, Gitleaks, Nuclei, Checkov, Horusec) into a unified platform with automatic deduplication, SLA tracking, risk-based prioritization, and compliance reporting. Use when: (1) Aggregating findings from multiple scanners across products and pipelines, (2) Tracking remediation status and SLA compliance against policy thresholds, (3) Deduplicating overlapping findings across security tools, (4) Generating vulnerability reports for compliance audits (SOC2, PCI-DSS, GDPR), (5) Managing security debt and vulnerability backlog across teams and applications.
version	0.1.0
maintainer	SirAppSec
category	devsecops
tags	["vulnerability-management","defectdojo","findings-aggregation","deduplication","sla-tracking","risk-management","compliance-reporting"]
frameworks	["OWASP","CWE","NIST","SOC2","PCI-DSS","GDPR"]
dependencies	{"python":">=3.9","packages":["requests"],"tools":["docker"]}
references	["https://defectdojo.github.io/django-DefectDojo/","https://github.com/DefectDojo/django-DefectDojo","https://owasp.org/www-project-defectdojo/"]

Vulnerability Management with DefectDojo

Overview

DefectDojo aggregates findings from every SecOpsAgentKit scanner into one platform—deduplicating across tools, tracking SLA compliance, and producing compliance-ready reports. It transforms isolated scanner outputs into a managed vulnerability backlog with ownership and remediation history.

Key concepts:

• Product: An application or system being tracked
• Engagement: A time-boxed security activity (sprint, assessment, CI/CD pipeline)
• Test: A scanner run within an engagement
• Finding: A deduplicated security issue with full lifecycle (Active → Mitigated → Closed)

Quick Start

Start DefectDojo locally:

git clone https://github.com/DefectDojo/django-DefectDojo.git
cd django-DefectDojo && docker compose up -d
# Access at http://localhost:8080 — change admin/admin password immediately

Import the first scan result:

pip install requests
./scripts/import_findings.py \
  --host http://localhost:8080 \
  --api-key <your-api-key> \
  --engagement-id 1 \
  --scan-type "Semgrep JSON Report" \
  semgrep-results.json

Retrieve your API key: DefectDojo UI → User (top-right) → API v2 Key.

Core Workflow

1. Setup: Products and Engagements

Create a Product (once per application) and an Engagement (once per sprint or pipeline):

# Create product
curl -s -X POST "$DD_HOST/api/v2/products/" \
  -H "Authorization: Token $DD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "My App", "description": "Main application", "prod_type": 1}'

# Create engagement — use template for full options
curl -s -X POST "$DD_HOST/api/v2/engagements/" \
  -H "Authorization: Token $DD_API_KEY" \
  -H "Content-Type: application/json" \
  -d @assets/defectdojo-engagement-template.json

See for a full CI/CD engagement template.