Burp Enterprise Integration with DefectDojo

Burp Enterprise Integration with DefectDojo

Burp Suite DAST, formerly Burp Suite Enterprise Edition, is PortSwigger's dynamic application security testing (DAST) platform for scheduling and running automated Burp Scanner scans across many web applications and APIs. It sits alongside Burp Suite Professional, the desktop tool penetration testers use, which exposes its own REST API for automated scans, and Dastardly, a free lightweight scanner from PortSwigger built on Burp Scanner for CI pipelines. Between them, DefectDojo can import Burp Suite DAST HTML reports, JSON pulled from the Burp Suite DAST GraphQL API, Burp Suite Professional XML issue exports, Burp REST API JSON, and Dastardly XML.

Burp Enterprise Integration with DefectDojo

We use Burp Suite DAST to scan our web estate on a schedule, and DefectDojo is where those results get owners. A Burp report tells you what Burp found on one scan; DefectDojo tells you whether that issue is new, who is fixing it, and whether it is past its SLA. Every Burp issue lands as a Finding on the Asset for that application, with the affected URLs as endpoints and the request and response evidence attached, next to the SAST and SCA results for the same code. Manual testing feeds the same Assets: our pentesters export issues from Burp Suite Professional as XML, and those land beside the scheduled scan results.

Why Burp Enterprise Matters

Burp Scanner is one of the most widely used web vulnerability scanners, and Burp Suite DAST runs it at scale.

• It crawls and audits running applications, which finds issues that only appear at runtime: missing security headers, injection flaws reachable through real requests, and server misconfigurations.
• Each issue comes with Burp's issue background, remediation guidance, references, and CWE classifications.
• Scans run on a schedule across many sites, so coverage doesn't depend on someone remembering to start a scan.
• Evidence includes the HTTP requests and responses that demonstrated the issue, which shortens the back-and-forth with developers.
• Burp tracks scans per site, but most programs need DAST results correlated with code scanning, pentests, and ticketing in one place.

Advantages of This Integration

What we gained by routing Burp results through DefectDojo:

• Grouped findings with every affected URL. The HTML and GraphQL parsers combine instances of the same issue type into one Finding and attach each affected URL as an endpoint, so one fix closes one Finding.
• Evidence travels with the Finding. Request and response pairs are stored on the Finding, which developers can review without access to Burp. Burp Suite Professional XML exports with Base64-encoded requests and responses are decoded the same way, and Burp Collaborator interactions are described in the finding detail.
• Pentest results in the same workflow. Issues a tester exports from Burp Suite Professional are grouped by issue type, so a manual test of an application arrives as a short list of Findings rather than one per request.
• CWE-based reporting. CWE numbers are extracted from Burp's vulnerability classifications, with the first used as the primary CWE.
• Lifecycle on reimport. Reimporting the next scan's report into the same Test mitigates issues that are gone, adds new ones, and reactivates regressions.
• SLAs, ownership, and Jira. Burp findings follow the same severity SLAs, assignment, risk acceptance, and Jira push as every other tool.
• Connector sync with DefectDojo Pro. The Burp Suite Enterprise connector pulls data through Burp's GraphQL API, with no report exports.

How This Integration Works

Choose the scan type that matches your Burp source.

Burp Suite DAST HTML report (Burp Enterprise Scan). Download a Standard Report as HTML from Burp Suite DAST and import it with Burp Enterprise Scan. The same parser is also registered as Burp Suite DAST Scan, the type's new name; pick one and use it consistently, since they are separate scan types in DefectDojo. For XML exported from Burp Suite Professional, use the Burp Scan type below.

Burp Suite Professional XML (Burp Scan). In Burp Suite Professional, select the issues to report (for example from the site map or the Dashboard issue list), choose Report selected issues, and pick XML as the format. Turn on the option to Base64-encode requests and responses, which DefectDojo recommends so the evidence decodes cleanly into the Finding view. The parser reads the issues root and each issue element (serial number, type, name, host, path, location, severity, confidence, background and remediation text, and request and response pairs). Import it with Burp Scan. HTML exports from Burp Suite Professional are not read by this parser.

Burp Suite DAST GraphQL API (Burp GraphQL API). Query issues from the GraphQL API, including issue_type details, severity, origin, path, and evidence, then save them as a JSON object with an Issues list. No need to filter duplicates: the parser combines issues with the same name.

Burp Suite Professional REST API (Burp REST API). Request a task's status from the Burp REST API scan endpoint (/v0.1/scan/{task_id} on the address where you enabled the API) and save the JSON response as burp-scan.json. The parser reads issue_found events and decodes the Base64 request and response segments into readable evidence.

Dastardly (Burp Dastardly Scan). Import the XML report Dastardly writes at the end of a CI scan. Dastardly reports results as test suites with failures, which the parser converts into findings.

Import the file. In the UI, open the Engagement, choose Import Scan Results, pick the scan type, and upload. Via the API (Community Edition and DefectDojo Pro):

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Burp Enterprise Scan" \
  -F "file=@burp-dast-report.html" \
  -F "product_name=customer-portal" \
  -F "engagement_name=Weekly DAST" \
  -F "auto_create_context=true"

With Universal Importer (DefectDojo Pro):

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Burp Dastardly Scan" \
  --report-path "./dastardly-report.xml" \
  --product-name "customer-portal" \
  --engagement-name "CI" \
  --auto-create-context

Burp Suite Enterprise connector (DefectDojo Pro). The connector calls Burp's GraphQL API. Create a Burp service account user with an API key (user accounts don't have one by default), then in the DefectDojo Pro UI enter the URL where you access Burp in the Location field and the service account's API key in the Secret field.

Data Granularity: What Gets Imported

Burp Enterprise Scan / Burp Suite DAST Scan (HTML):

Burp Scan (Burp Suite Professional XML):

Burp GraphQL API (JSON):

Burp REST API (JSON):

Burp Dastardly Scan (XML): title comes from each failure's message, severity from its type, description from the failure text, and the URL from the test suite name. Dastardly findings use the legacy algorithm (title, CWE, line, file path, description). Every Burp scan type marks findings as dynamic.

Use Cases

Scheduled DAST across a web estate: Burp Suite DAST scans 50 sites weekly. Each site maps to an Asset, and each weekly report is reimported into the same Test, so the security team sees new issues, fixed issues, and regressions per site.

CI checks with Dastardly: A pipeline runs Dastardly against a staging deployment and imports the XML, giving developers quick feedback while full Burp Suite DAST scans run on a slower schedule.

Manual pentests: A tester working in Burp Suite Professional exports the confirmed issues as XML at the end of an engagement and imports them with Burp Scan into a pentest Engagement on the Asset, where they get owners and SLAs like scanner results.

Pentester automation: A consultant drives Burp Suite Professional through its REST API and imports each task's JSON, with request and response evidence decoded for the client's developers.

Continuous sync with DefectDojo Pro: Teams already using Burp Suite DAST connect it once and let scheduled syncs keep findings current without exports.

Operational Tips

• Keep one scan type per Test. Burp Enterprise Scan and Burp Suite DAST Scan run the same parser but are separate scan types and won't deduplicate against each other.
• Expect one Finding per issue type in HTML and GraphQL imports. Remediation of a single path doesn't close the Finding while other paths are still affected; review the endpoint list.
• For Burp Scan, export only issues you have reviewed. The parser imports every issue in the XML, including tentative ones, and Burp's confidence is kept in Scanner Confidence for filtering.
• Burp Scan deduplicates on title, severity, and Burp's issue type ID, so changing an issue's severity in Burp before export will create a new Finding on the next import.
• In REST API imports, issues Burp marks false_positive arrive flagged as false positives, and undefined severities become Info.
• Burp HTML imports have no scan date, so findings take the import date. Import promptly after each scan for accurate SLA clocks.
• Use minimum_severity=Low if Info issues such as header notes would flood the backlog.
• Tag imports with the site or environment (for example tags=staging) so DAST findings from different environments stay separate in metrics.