Aqua Security Integration with DefectDojo

Aqua Security Integration with DefectDojo

Aqua Security is a cloud native security platform from Aqua Security Software. Its image scanning component inspects container images in registries and CI/CD pipelines, identifies operating system packages and application dependencies, and matches them against vulnerability data, scoring each issue with Aqua's own severity alongside vendor and NVD scores. CI/CD scans can also flag sensitive data such as keys left in image layers. Aqua produces JSON scan reports from its Scanner CLI and CI/CD plugins, and the same data can be retrieved from the Aqua REST API.

Aqua Security Integration with DefectDojo

We use Aqua to scan every image before it is promoted, and DefectDojo to keep track of what those scans tell us over time. Aqua is good at answering whether an image passes assurance policy today. DefectDojo answers the follow-up questions: which CVEs are new since last week's build, who owns them, and how long the Criticals have been open. Importing the Aqua JSON turns each vulnerable package into a Finding on the Asset that ships the image, deduplicated against earlier scans and measured against our SLAs. On DefectDojo Pro, the Aqua Security and Aqua Supply Chain connectors can pull the same data on a schedule instead of relying on file uploads.

Why Aqua Security Matters

Container images bundle a full userland, and much of their risk comes from packages that nobody on the application team selected directly.

• Aqua scans OS packages and application libraries in each image, in registries and in CI before images are pushed.
• Its reports carry several scoring sources per vulnerability (Aqua, vendor, and NVD), which helps when a distribution rates a CVE differently than NVD.
• CI/CD scan reports also surface sensitive items found in image layers, a class of issue CVE scanning alone misses.
• Fix versions are included where they exist, so engineers know which upgrade closes the issue.
• A scan result describes one image at one moment. Without a platform behind it, repeated builds produce the same list with no history.

Advantages of This Integration

What we gained by sending Aqua results through DefectDojo:

• Deduplication on package identity. DefectDojo hashes Aqua Scan findings on severity, vulnerability IDs, component name, and component version, so the same CVE in the same package is matched across scans.
• Severity reasoning preserved. The parser records every available score (Aqua severity, Aqua score, vendor score, NVD v3 and v2) in the Severity Justification field and states which one decided the severity.
• Exploit likelihood data. EPSS score and percentile are carried over when Aqua includes them, which helps prioritize within a severity band.
• Lifecycle across rebuilds. Reimporting each new scan into the same Test mitigates CVEs that a base image update removed and reactivates any that return.
• Container risk next to code risk. Image findings sit on the same Asset as SAST, SCA, and DAST results, under one set of SLAs, assignments, and Jira workflows.
• Scheduled sync in DefectDojo Pro. The Aqua Security connector imports image and workload vulnerabilities across the whole tenant, and the Aqua Supply Chain connector adds Aqua's code-security findings (SCA, secrets, IaC, SAST, and pipeline misconfigurations) per repository.

How This Integration Works

DefectDojo imports Aqua results with the Aqua Scan scan type. The parser detects the JSON layout automatically and supports four of them.

1. Get a JSON report. The most complete option is a CI/CD scan report from Aqua's Scanner CLI or one of its CI/CD plugins. It has a top-level resources list and is the only layout from which DefectDojo also imports sensitive data findings. Reports produced by Aqua jobs in Azure DevOps arrive as a JSON array and are handled too. You can also pull vulnerability data from the Aqua REST API, using either /api/v1/scanner/registry/<registryName>/image/<imageName>/scan_result or /api/v2/risks/vulnerabilities filtered to the image. API responses contain vulnerabilities only.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select Aqua Scan, and upload the file. For automation, use the import API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Aqua Scan" \
  -F "file=@aqua-orders-service.json" \
  -F "product_name=orders-service" \
  -F "engagement_name=Image Scans" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Aqua Scan" \
  --report-path "./aqua-orders-service.json" \
  --product-name "orders-service" \
  --engagement-name "Image Scans" \
  --auto-create-context

3. Reimport per build. Send later scans of the same image to /api/v2/reimport-scan/ against the same Test to keep its history in one place.

Option: Aqua Security connector (DefectDojo Pro). Instead of exporting files, configure the connector in the DefectDojo Pro UI. It needs an admin-generated Aqua API key and secret, created under Account Management > API Keys (the secret is shown only once). Enter the tenant URL (https://<your-tenant>.cloud.aquasec.com) in Location, the key in API Key, the secret in API Secret, and optionally a Minimum Severity. Each scanned registry/repository becomes a Record, and its image and workload vulnerabilities are imported as findings on each sync.

Option: Aqua Supply Chain connector (DefectDojo Pro). This is a separate connector for Aqua Supply Chain Security, using the same API key and secret. Set Location to your region's edge host (for example https://eu-central-1.edge.cloud.aquasec.com, not the tenant URL) and Auth Host to your region's CSPM API host (for example https://eu-1.api.cloudsploit.com; US can stay blank). Scan Categories optionally limits import to vulnerabilities, secrets, iacMisconfigurations, sast, or pipelineMisconfigurations. Each repository becomes a Record. The default branch is always imported; Branch adds named or wildcard branches, and Track Scanned Branches gives each branch its own Engagement.

Data Granularity: What Gets Imported

The table describes CI/CD reports and API v2 results, which share the same mapping.

Sensitive data (CI/CD reports only). Each sensitive item becomes an Info Finding whose description lists the item, layer, layer digest, and path.

API v1 results. Findings are titled CVE-ID: file, severity comes from the numeric score, and mitigation uses solution, then "Upgrade to" the fix version, then "No known mitigation". Component fields are not set in this layout.

Within one report, entries with the same package CPE, vulnerability name, and path are collapsed into one Finding.

Connector findings (DefectDojo Pro). The Aqua Security connector maps each registry/repository to a Record. The Aqua Supply Chain connector maps each repository to a Record, maps Aqua's 0-4 severity to Info, Low, Medium, High, and Critical, tags each finding category:<value>, and collapses byte-identical duplicate rows into one finding, noting the count in the description.

Use Cases

In CI before an image is pushed: The pipeline runs an Aqua scan and reimports the report into a Test for that image. Developers see only what their change introduced, and a release check can query DefectDojo for new Critical findings.

For registry-wide visibility: A platform team pulls API v2 results for each production image on a schedule and imports them into the owning Asset. Security leads get image risk by service, not by registry.

When cleaning up secrets in images: Sensitive item findings from CI/CD reports land as Info Findings with the layer and path, so the team can assign them, track removal, and confirm on the next scan that they are gone.

During base image migrations: After switching a fleet to a slimmer base image, reimports show which CVEs disappeared across services and which remain in application-installed packages.

Operational Tips

• Prefer CI/CD scan reports over API exports when you want sensitive data findings. API results list vulnerabilities only.
• Pick one report layout per pipeline. API v1 results don't set component fields, which changes their hash codes compared with CI/CD or API v2 imports of the same image.
• Spot-check numeric severities. The parser's CVSS bands treat a score of exactly 4.0 or 7.0 as Critical, so review those findings before SLAs apply.
• Text severities other than high, medium, low, or negligible are imported as Critical.
• Set minimum_severity=Low to keep negligible OS package CVEs and Info sensitive items out of a Test if your team triages them elsewhere.
• Tag imports with image name and tag (for example tags=orders-service,1.8.0) to filter findings by release.
• For the Aqua Supply Chain connector, a 405 on validation usually means Auth Host is set to the edge host. Keep the edge host in Location and the regional api.cloudsploit.com host in Auth Host.