Upload Trivy result.json file to DefectDojo

Question

I am using trivy to do docker scanning and then saving the output into result.json file. Now I am trying to send the file to DefectDojo to visualize it there, how can I do that?

Answer 1

Go to "Products" , Select a product, in the "Findings" tab > "Import Scan Results"

or use API: create an engagement:

curl -X POST   "https://dojo:8080/api/v2/engagements/" -H "Authorization: Token <your token>"  -F "name=Test" -F "product=<Product ID>" -F "target_start=2022-06-14" -F "target_end=2022-06-14"

Import Scan:

 curl -X POST "https://dojo:8080/api/v2/import-scan/" -H  "accept: application/json" -H  "Content-Type: multipart/form-data"  -H "Authorization: Token <your token>" -F "minimum_severity=Info" -F "active=true" -F "verified=true" -F "scan_type=Trivy Scan" -F "close_old_findings=false" -F "push_to_jira=false" -F "[email protected]" -F "product_name=Test" -F "scan_date=2022-06-14" -F "engagement_name=Test"

Answer 2

There's another problem with DefectDojo's importer for Trivy: They parse only CVEs, but trivy can find secrets as well.

Try this tool as well: https://docs.whitespots.io/appsec-portal/install/deployment-guide/installation