Aqua Security

Aqua Security Integration with DefectDojo

Aqua Security is purpose-built for the container and cloud-native stack — scanning images in CI, assessing Kubernetes configurations, enforcing runtime policies, and securing the software supply chain from code to production. It produces some of the most contextually rich container security findings available: vulnerability data tied to specific image layers, runtime behavior anomalies, and supply chain integrity signals that broader cloud security platforms don't match in depth. What Aqua doesn't provide is a cross-functional vulnerability management workflow. Findings need to move from Aqua's console into a platform where security teams can track remediation commitments, enforce SLAs, manage risk acceptance decisions across multiple teams, and report on posture longitudinally. Integrating Aqua Security with DefectDojo provides exactly that operational layer — turning Aqua's signal into a managed, auditable remediation program.

Why Aqua Security Matters

Aqua has built its platform specifically around the security requirements of containerized and cloud-native workloads, with depth that general-purpose security platforms rarely match.

• Image scanning covers OS packages and language ecosystem dependencies within container images, mapping CVEs to specific layers and identifying which layer introduced each vulnerability — making remediation more precise than image-level findings alone
• Kubernetes Security Posture Management (KSPM) assesses cluster configurations, RBAC policies, network policies, and workload settings against CIS benchmarks and Aqua's own best practice rules — covering both the control plane and workload configurations
• Software supply chain security verifies image signatures, provenance attestations, and bill-of-materials integrity — critical for environments subject to SLSA or SSDF requirements
• Runtime security monitors container behavior against defined policies, detecting anomalous process execution, file system writes, and network connections in production workloads
• Aqua Trivy, Aqua's open-source scanner, provides the same vulnerability scanning engine in a lightweight CLI form — widely used in CI pipelines and producing JSON output that DefectDojo can ingest directly
• Findings are exportable via the Aqua REST API and Trivy CLI in JSON format, making integration with DefectDojo straightforward across both the enterprise platform and the open-source scanner

Advantages of This Integration

Aqua surfaces container and cloud-native risk with precision. DefectDojo gives that risk a managed lifecycle with accountability at every stage.

• Persistent vulnerability records across image versions: Container images are immutable and tagged — but new image versions are produced constantly. DefectDojo tracks findings across image versions, showing which CVEs persisted through a base image update, which were resolved, and which were newly introduced — giving you a longitudinal record that Aqua's live console doesn't retain across all historical image versions.
• SLA enforcement for container vulnerabilities: DefectDojo applies configurable SLA policies by severity across imported Aqua findings. Critical container CVEs get a 7-day remediation target; High severity findings get 30 days. Breach tracking surfaces overdue findings in dashboards and reports — turning Aqua severity ratings into enforceable deadlines with documented breach history.
• Cross-team remediation ownership: Container vulnerabilities span multiple owners — OS-level CVEs belong to the platform or base image team, application dependency CVEs belong to app developers, Kubernetes misconfigurations belong to platform engineering. DefectDojo's assignment model routes each finding to the right owner without a manual triage meeting for every scan cycle.
• Risk acceptance with audit trail: Many container CVEs have no available fix for extended periods, or exist in image layers that are not reachable by attackers. DefectDojo captures risk acceptance decisions with documented rationale, approver identity, and expiration dates — persistent across reimports and auditable for compliance review.
• Deduplication across registries and environments: The same CVE appearing in an image across dev, staging, and production registries doesn't generate three independent findings if your DefectDojo product structure reflects environment tiers appropriately. You address the root cause once, at the image level.
• Portfolio visibility across all containerized applications: Organizations running Aqua across dozens of applications and hundreds of images get aggregated metrics in DefectDojo — open findings by severity, image, age, and SLA status — without manually pulling reports from Aqua for each application.
• Ticketing workflow for remediation handoff: Triaged Aqua findings push from DefectDojo to Jira, GitHub Issues, or ServiceNow with CVE details, affected package, image layer context, and fix version guidance — giving developers and platform engineers what they need to act without requiring Aqua console access.

How This Integration Works

Aqua Security findings are exported via Trivy CLI (for open-source usage) or the Aqua REST API (for Aqua Enterprise), then imported into DefectDojo using the appropriate parser.

Option A — Trivy CLI (open-source, recommended for CI pipelines)

# Scan a container image and output JSON

trivy image --format json --output trivy-results.json <image>:<tag>

# Scan with specific severity filters

trivy image --format json --output trivy-results.json \

--severity CRITICAL,HIGH <image>:<tag>

# Scan a filesystem or repository

trivy fs --format json --output trivy-fs-results.json .

# Scan a Kubernetes cluster

trivy k8s --format json --output trivy-k8s-results.json cluster

Import Trivy results using the Trivy Scan scan type:

curl -X POST https://<defectdojo-host>/api/v2/import-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=Trivy Scan" \

-F "file=@trivy-results.json" \

-F "engagement=<engagement-id>" \

-F "product=<product-id>" \

-F "active=true" \

-F "verified=false"

Option B — Aqua Enterprise API

# Retrieve image scan results from Aqua Enterprise API

curl -X GET "https://<aqua-host>/api/v2/scanner/registry/<registry>/image/<image>/tag/<tag>/scan_result" \

-H "Authorization: Bearer <aqua-api-token>" \

-H "Content-Type: application/json" \

-o aqua-results.json

Import Aqua Enterprise results using the Aqua Security Scan scan type:

curl -X POST https://<defectdojo-host>/api/v2/import-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=Aqua Security Scan" \

-F "file=@aqua-results.json" \

-F "engagement=<engagement-id>" \

-F "product=<product-id>" \

-F "active=true" \

-F "verified=false"

Step 3 — Reimport for recurring scans

For images scanned on a recurring cadence, use the reimport endpoint to update existing findings rather than accumulate duplicate test records:

curl -X POST https://<defectdojo-host>/api/v2/reimport-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=Trivy Scan" \

-F "file=@trivy-results.json" \

-F "test=<test-id>"

DefectDojo marks findings absent from the new scan as resolved, creates records for new findings, and leaves previously accepted or false-positived findings untouched.

Data Granularity: What Gets Imported

Use Cases

In a container build pipeline: Trivy scans every image on build, before it's pushed to the registry. Results import into DefectDojo via the API at the end of the build stage. Security engineers triage new Critical and High findings in DefectDojo, assign remediation to the relevant application or platform team, and track SLA compliance through dashboards — without reviewing raw JSON output or navigating Aqua's console for every build. Images with accepted risk findings don't re-trigger triage on the next build cycle.

For base image governance across a large organization: A central platform team maintains a library of approved base images used across hundreds of microservices. Aqua or Trivy scans each base image on a nightly schedule. DefectDojo aggregates findings across all base image versions, showing which CVEs are present in each, which have fixes available, and which have been in the library the longest without remediation. When a base image update resolves a set of CVEs, the reimport automatically closes the corresponding DefectDojo findings — giving the platform team a clean record of what changed.

For Kubernetes cluster security posture management: Trivy's Kubernetes scanning mode assesses cluster misconfigurations, workload security contexts, RBAC over-permissions, and network policy gaps. Results import into a dedicated DefectDojo engagement for cluster security, separate from image vulnerability findings. Platform engineering owns the Kubernetes findings; application teams own the image findings — with separate SLA policies and assignment rules for each.

During a software supply chain review: Aqua's supply chain security capabilities verify image signatures and SBOM integrity. Findings from unsigned images, provenance failures, or SBOM gaps import into DefectDojo as part of a supply chain security engagement, giving security teams a tracked remediation record for supply chain controls — useful for SLSA compliance evidence and internal policy enforcement.

For compliance evidence across regulated environments: Financial services, healthcare, and government environments frequently require documented evidence of continuous container security scanning with remediation tracking. DefectDojo's engagement history, finding lifecycle records, and risk acceptance audit trail covering Aqua and Trivy findings provide structured compliance evidence for PCI DSS, HIPAA, FedRAMP, and SOC 2 requirements without additional manual reporting work.

Operational Tips

• Structure products by application, not by image tag: Image tags change constantly. Map DefectDojo products to applications or services, and use engagements to represent scan sessions against specific image versions. This keeps your product history stable even as image tags evolve.
• Use image digest rather than tag in engagement names: Tags like latest are mutable — the same tag can point to different images over time. Using the image digest (e.g., sha256:abc123...) in the DefectDojo engagement name gives you a precise, immutable audit record of exactly which image was scanned.
• Separate OS and application dependency findings by engagement: OS-level CVEs are typically the base image team's responsibility; application dependency CVEs belong to app developers. Splitting these into separate engagements in DefectDojo makes ownership and SLA tracking cleaner, even if they come from the same Trivy scan output.
• Filter UNKNOWN severity findings on import: Trivy reports UNKNOWN severity for CVEs where the upstream advisory source hasn't yet assigned a severity rating. These findings are frequently noise at the time of scanning. Importing them as inactive keeps your active queue focused on rated, actionable risk.
• Leverage EPSS scores for prioritization: Trivy includes EPSS (Exploit Prediction Scoring System) scores where available. These provide a data-driven exploitability signal beyond CVSS that's particularly useful for triaging the long tail of Medium severity findings. Capture EPSS values in DefectDojo finding notes during triage to preserve this context for SLA and risk acceptance decisions.
• Align scan frequency with your registry push cadence: Scanning on every image push gives DefectDojo the most current finding state, but can generate high import volume in active CI environments. For lower-velocity registries, daily scheduled scans with automated reimport strike a reasonable balance between data freshness and operational overhead.
• Track will_not_fix and end_of_life package status: Trivy flags packages with a will_not_fix or end_of_life status from the upstream vendor. These findings warrant a risk acceptance decision with documented rationale in DefectDojo rather than an open remediation ticket — the fix will never come from the vendor, and the appropriate response is a compensating control or package replacement decision.
• Use tags to capture registry and environment context: Tag DefectDojo findings on import with the source registry, environment tier (dev/staging/prod), and base image name. These tags enable filtering and reporting by environment in DefectDojo — useful for determining whether a finding pattern is isolated to a specific registry or systemic across your container estate.