AppCheck Integration with DefectDojo

AppCheck Integration with DefectDojo

AppCheck is a commercial vulnerability scanning platform from AppCheck Ltd, a UK security company, sold as AppCheck NG. It scans web applications, APIs, and network infrastructure from a single platform, and it runs several scanning engines behind the scenes: its own web application scanner alongside Nmap for port and service discovery and OpenVAS for network vulnerability checks. AppCheck normalizes the output of those engines into one result set, which can be exported as JSON for import into DefectDojo.

AppCheck Integration with DefectDojo

We use AppCheck for scheduled external scans of our web applications and perimeter, and DefectDojo is where those results get worked. An AppCheck export mixes web application issues, open ports, and network vulnerability checks in one file. The DefectDojo parser handles each engine's output correctly and turns every item into a Finding on the right Asset, with CVSS-based severity, endpoints, and the scanner's own notes. From there, AppCheck findings follow the same SLAs, assignment, and ticketing as findings from every other tool in our stack. On DefectDojo Pro, the AppCheck connector can pull those results on a schedule instead of relying on manual exports.

Why AppCheck Matters

External attack surface changes constantly: new hosts appear, services get exposed, and web applications ship weekly. AppCheck covers both the application layer and the infrastructure underneath it.

• One scan can cover web application flaws, exposed services, and known vulnerabilities in network software.
• Results carry CVSS scores and vectors, and some include an EPSS score, which gives a consistent basis for prioritizing.
• For web findings from AppCheck's own engine, the export can include the HTTP request and response that demonstrate the issue.
• Each result carries a status in AppCheck, such as unfixed or fixed, so triage decisions made there are part of the export.
• Its results still live in their own portal. Without a central platform, those findings sit apart from code, dependency, and cloud findings for the same application.

Advantages of This Integration

What we gained by importing AppCheck results into DefectDojo:

• Engine-aware parsing. The parser routes each item to logic for the engine that produced it (AppCheck's scanner, Nmap, or OpenVAS), with a generic fallback for anything else.
• Severity you can defend. Severity is derived from CVSS: v4 base score first, then v3, then v2, then the vectors if no score is present. SLA timers start from a recognized standard.
• Status carried over. Items AppCheck marks as fixed import inactive, false positives arrive flagged as false positives, and acceptable risks arrive risk-accepted.
• Less noise per import. Items with the same title, severity, endpoints, and engine collapse into one Finding within a file.
• No export step with DefectDojo Pro. The AppCheck connector discovers every scan on the account and creates a Record for each one, so new scans are picked up without per-scan setup.
• One remediation workflow. Reimporting into the same Test mitigates findings that disappeared, and findings can be assigned, ticketed in Jira, and reported on with the rest of the Asset's risk.

How This Integration Works

DefectDojo imports AppCheck results with the AppCheck Web Application Scanner scan type. The parser expects a JSON file with a top-level items array of vulnerability records.

1. Export results from AppCheck. Export the scan's vulnerabilities from AppCheck in JSON format. Each record's meta.scanning_engine.name tells the parser which engine produced it. Records without that field are handled by the generic parser.

2. Import the file. In the UI, open the Engagement, choose Import Scan Results, select AppCheck Web Application Scanner, and upload the JSON. To automate the import (Community Edition and DefectDojo Pro):

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=AppCheck Web Application Scanner" \
  -F "file=@appcheck-results.json" \
  -F "product_name=public-website" \
  -F "engagement_name=External Scans" \
  -F "auto_create_context=true"

DefectDojo Pro users can run it with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "AppCheck Web Application Scanner" \
  --report-path "./appcheck-results.json" \
  --product-name "public-website" \
  --engagement-name "External Scans" \
  --auto-create-context

Option: AppCheck connector (DefectDojo Pro). Instead of exporting files, configure the AppCheck connector in the DefectDojo Pro UI. You need an AppCheck API key from the API section of your AppCheck account. Set Location to https://api.appcheck-ng.com, enter the key in the API Key field, and optionally set a Minimum Severity to limit which findings are imported. There is no per-scan configuration: the connector discovers every scan and creates a Record for each, and you map those Records to Assets.

3. Reimport on your scan schedule. For a recurring AppCheck scan, reimport each new export into the same Test with /api/v2/reimport-scan/, so findings that AppCheck no longer reports are mitigated and returning ones are reactivated.

Data Granularity: What Gets Imported

With the DefectDojo Pro connector, each AppCheck scan becomes a Record, and its findings come from that scan's most recent completed run. Each finding carries the engine that reported it (AppCheck's scanner, Nmap, or OpenVAS).

Use Cases

For perimeter monitoring: A security team runs a weekly AppCheck scan of internet-facing hosts and reimports the export into an Asset for the external estate. Newly exposed services and fresh network vulnerabilities show up as new Findings with owners, while resolved items close on their own.

For web application releases: Before a major release, the team scans the staging site with AppCheck and imports the results into the release Engagement. Web findings arrive with request and response evidence, so developers can confirm the issue without logging into AppCheck.

For managed service providers: A provider scanning many clients imports each client's results into its own Organization and Asset in DefectDojo, giving each client a separate remediation view and SLA report.

To combine with other testing: AppCheck results sit beside SAST, SCA, and pentest findings on the same Asset, so one report covers the application from code to perimeter.

Operational Tips

• Expect Info findings where AppCheck had no CVSS data. Severity comes only from CVSS scores and vectors, so review the Info bucket after the first import rather than filtering it out with minimum_severity.
• Deduplication across imports uses only title and severity. If the same issue appears on many hosts, it can match a single existing Finding in the Asset, so keep distinct environments in separate Assets.
• Use one Test per recurring AppCheck scan and reimport into it. Mixing scans of different targets in one Test will mitigate findings from whichever target is missing in the latest file.
• Mark false positives and acceptable risks in AppCheck before export when you can. The parser honors those statuses, which saves triage in DefectDojo.
• Nmap items create an endpoint per open port, which makes port-level reporting possible. Tag imports by scan scope (for example tags=external,weekly) to filter them.
• If you use the DefectDojo Pro connector, treat the AppCheck API key like a password. AppCheck sends it as part of the request path, so it forms part of the URL. The connector reads only completed runs, so a scan still in progress will not shrink the finding set.
• AppCheck's own engine supplies request and response pairs. For OpenVAS and generic items, look in the description for the detail fields.