Black Duck Integration with DefectDojo

Black Duck Integration with DefectDojo

Black Duck is a family of application security products from Black Duck Software, the company formed in 2024 when Synopsys sold its Software Integrity Group. Black Duck SCA (long known as Black Duck Hub) builds a bill of materials for an application's open source and third-party components and matches it against the Black Duck KnowledgeBase for vulnerabilities and license risk. Black Duck Binary Analysis (BDBA) does the same for compiled artifacts such as executables, libraries, containers, and firmware, identifying components even when no source code is available. Both export results as CSV, which DefectDojo imports.

Black Duck Integration with DefectDojo

We use Black Duck to answer a question our developers can't answer from memory: which open source components are inside this product, and which of them are vulnerable. DefectDojo is where those answers turn into work. Black Duck findings land on the same Asset as our SAST and DAST results, each vulnerable component version becomes a Finding with an owner and an SLA, and reimporting after an upgrade closes what was fixed. For teams on DefectDojo Pro, the Black Duck connector removes the export step entirely.

Why Black Duck Matters

Most of the code in a modern application was written by someone else. Black Duck is built to account for it.

• Black Duck SCA identifies components from package manifests, source signatures, and scans of a codebase, then reports known vulnerabilities by component version.
• BDBA looks inside binaries and archives, which covers vendor-supplied software, firmware, and builds where the source tree isn't available.
• Findings reference the Black Duck Security Advisory (BDSA) and CVE where one exists, along with CVSS data and the latest available version.
• Black Duck tracks a project's components well, but security teams usually need those results next to findings from other tools, with SLAs and ticketing they already run.

Advantages of This Integration

What we gained by routing Black Duck results through DefectDojo:

• Two products, one place. Source-based SCA findings and binary analysis findings for the same application can sit on one Asset, alongside every other scanner.
• License risk as findings. The Blackduck Component Risk scan type turns components whose license is In Violation of policy, or flagged with a license risk, into findings next to the security risks, so legal review items get owners and due dates too.
• Deduplication tuned to each report. Black Duck SCA findings are hashed on title, vulnerability IDs, component name, and component version. BDBA findings use a unique ID the parser builds from file path, object SHA1, and title.
• Lifecycle on reimport. Reimporting a fresh export into the same Test mitigates components that were upgraded or removed, adds new ones, and reactivates regressions.
• Severity-based SLAs. Black Duck's security risk rating (SCA) or the CVSS-derived severity (BDBA) feeds DefectDojo's SLA rules, so component CVEs follow the same deadlines as everything else.
• Fix information on the Finding. BDBA findings carry the latest component version and a fix_available flag, so filters can separate upgradeable components from ones with no patched release.
• Automated sync with DefectDojo Pro. The Black Duck connector pulls vulnerable BOM components per project on a schedule, with no manual export.

How This Integration Works

The row covers three file scan types, Blackduck Hub Scan and Blackduck Component Risk for Black Duck SCA and Blackduck Binary Analysis for BDBA, plus the DefectDojo Pro connector.

Black Duck SCA (Blackduck Hub Scan). Run a Version Details report on the project version in Black Duck, including the Vulnerabilities and Source categories. Black Duck delivers a zip containing a security_<timestamp>.csv and a source_<timestamp>.csv, among others. DefectDojo accepts either:

• The zip file. The parser reads the security CSV for findings and the source (or older files) CSV for file locations.
• A single security CSV. Findings import the same way but have no file location information.

Black Duck SCA (Blackduck Component Risk). Use this scan type when you want one finding per vulnerable component version plus license risk findings. Include the Components and Vulnerabilities categories in the Version Details report (Source is optional and adds path context to license findings) and upload the zip. The parser only accepts a zip and looks for CSVs whose names contain component and security.

Black Duck Binary Analysis. Export the vulnerability results for a scanned artifact from BDBA as CSV and import that single file.

Import the file. In the UI, open the Engagement, choose Import Scan Results, pick the scan type, and upload the file. For automation, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Blackduck Hub Scan" \
  -F "file=@orders-api-1.8.0.zip" \
  -F "product_name=orders-api" \
  -F "engagement_name=Release 1.8" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer, here with a BDBA export:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Blackduck Binary Analysis" \
  --report-path "./firmware-2.3-bdba.csv" \
  --product-name "gateway-firmware" \
  --engagement-name "Release 2.3" \
  --auto-create-context

Black Duck connector (DefectDojo Pro). The connector pulls SCA findings directly from a Black Duck instance. Configure it in the DefectDojo Pro UI with:

1. Your Black Duck URL in the Location field, for example https://your-company.app.blackduck.com.
2. A Black Duck API token, created under My Access Tokens with at least read access, in the Secret field.
3. Optionally, a Minimum Severity to limit what is imported.

DefectDojo discovers every project and creates a Record for each, which you map to an Asset. By default it imports the project's released version (falling back to its first version), and each vulnerable BOM component becomes a finding titled {vulnerability} in {component}:{version}. Connector findings use their own scan type, Black Duck - Connectors Import, separate from the file parsers.

A note on the older API pull: the BlackDuck API scan type configured through Tool Configuration is deprecated as of 3.2.0 and will be removed in 3.5.0 (November 2026). Move to the connector or to file import.

Data Granularity: What Gets Imported

Blackduck Hub Scan (security CSV, optionally with source CSV):

Blackduck Component Risk (zip with components and security CSVs):

Blackduck Binary Analysis (CSV):

Within one BDBA file, repeated rows for the same key increase the occurrence count instead of creating new findings. In Black Duck SCA imports, rows with the same title and vulnerability source are merged.

Use Cases

Release gating: Before each release, the team exports a Version Details report and reimports it into the release Engagement. Product owners see which component CVEs are new since the last version and which were fixed by upgrades.

Vendor and firmware review: A team receiving third-party binaries runs them through BDBA and imports the CSV into an Asset per vendor product. Findings get owners and SLAs even though the team never sees the source.

Continuous sync with DefectDojo Pro: An organization with hundreds of Black Duck projects uses the connector, maps each Record to its Asset, and lets scheduled syncs keep SCA findings current without anyone running exports.

License compliance: A legal or OSPO team imports the Component Risk zip for each release. Components In Violation of license policy arrive as High findings, and those marked for review come in at their license risk level, so the review queue lives next to the security work.

Portfolio reporting: Security leaders combine Black Duck results with container and SAST findings to report open source risk by team, rather than reading Black Duck dashboards and other tools separately.

Operational Tips

• Import the zip rather than the bare security CSV for Black Duck SCA when file locations matter. Without the source CSV, findings carry no path.
• Keep each Black Duck project version mapped to one Test and reimport into it, so upgrades show up as mitigated findings.
• Check BDBA rows without a CVSS vector. The parser falls back to a zero-impact CVSS 3.1 vector that scores 0.0, so review those findings' severity during triage.
• Filter BDBA findings on Fix Available to prioritize components with an upgrade path, and use risk acceptance with an expiry for those without one.
• Choose Blackduck Hub Scan or Blackduck Component Risk per Test, not both. Component Risk rolls all CVEs for a component version into one finding, while Hub Scan creates one finding per vulnerability, and the two won't deduplicate against each other.
• Don't mix file imports and connector syncs for the same project in one Test. They use different scan types, so their findings won't deduplicate against each other.
• Migrate any BlackDuck API Tool Configuration setups before the 3.5.0 release removes them.