Contrast Security Integration with DefectDojo

Contrast Integration with DefectDojo

Contrast Assess is the interactive application security testing (IAST) product from Contrast Security. It uses an agent loaded into a running application (Java, .NET, Node.js, Python, Ruby, and other supported runtimes) to watch data flow through the code while the app is exercised by tests or real traffic, and it reports vulnerabilities such as injection flaws, insecure configuration, and missing security controls along with the request that triggered them. Findings are managed in the Contrast platform, can be exported as CSV, and are available through the Contrast REST API.

Contrast Integration with DefectDojo

We run Contrast Assess in our QA environments because it confirms vulnerabilities in code paths that actually execute, which cuts down the arguments about whether a finding is real. DefectDojo is where those findings become tracked work. Importing Contrast results into DefectDojo puts each vulnerability on the Asset that owns the application, next to its SAST, SCA, and DAST results, with an owner, an SLA, and a history we can report on. With DefectDojo Pro, the Contrast connector keeps that in sync without manual exports.

Why Contrast Matters

Instrumentation sees things neither a scanner on the outside nor a code scanner on the inside sees alone.

• Contrast observes real requests reaching vulnerable code, so its findings include the URI, method, and request data involved.
• Each finding maps to a CWE and a Contrast rule, which makes it easy to group by vulnerability class.
• It runs continuously while QA tests or integration suites execute, so coverage grows as test coverage grows.
• Contrast's own platform tracks findings per application, but security teams still need those results alongside every other tool's output to see the whole risk picture for an Asset.

Advantages of This Integration

What we gained by routing Contrast findings through DefectDojo:

• IAST next to everything else. Contrast findings sit on the same Asset as scanner and pentest results, so reporting and SLA metrics cover the application as a whole.
• Grouped occurrences. Rows in the CSV that share a Contrast Vulnerability ID are merged into one Finding with all of their endpoints and an occurrence count, instead of one Finding per request.
• Lifecycle on reimport. Reimporting a newer export into the same Test mitigates findings that are gone and adds new ones.
• Owners and tickets. Findings can be assigned, commented on, risk-accepted, or pushed to Jira from DefectDojo.
• Automated sync with DefectDojo Pro. The Contrast connector pulls vulnerabilities from the Contrast Assess API on a schedule, with one Record per Contrast application.

How This Integration Works

There are two ways to get Contrast findings into DefectDojo.

Option 1: CSV file import (Community Edition and DefectDojo Pro). Export the vulnerability list from Contrast as CSV. The parser expects Contrast's column layout, including Vulnerability Name, Vulnerability ID, Rule Name, Severity, Status, First Seen, CWE ID, Request Protocol, and Request URI. Import it with the Contrast Scan scan type. In the UI, open the Engagement, choose Import Scan Results, select Contrast Scan, and upload the CSV. To automate it:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Contrast Scan" \
  -F "file=@contrast-vulnerabilities.csv" \
  -F "product_name=orders-service" \
  -F "engagement_name=QA IAST" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Contrast Scan" \
  --report-path "./contrast-vulnerabilities.csv" \
  --product-name "orders-service" \
  --engagement-name "QA IAST" \
  --auto-create-context

Option 2: Contrast connector (DefectDojo Pro). The connector uses the Contrast Assess REST API. DefectDojo discovers the applications in your Contrast organization and creates a Record for each, which you map to a DefectDojo Asset. Configure it with:

1. The base URL you use for Contrast in the Location field, such as https://app.contrastsecurity.com or your regional or self-hosted Team Server URL.
2. The account login email in Username, the organization API Key, and the personal Service Key, all found in Contrast under User Settings > Profile > Your Keys. A dedicated service account keeps automated activity separate from people.
3. The Organization ID (a UUID) of the organization to import from.
4. Optionally, a Minimum Severity to limit which findings are imported.

Data Granularity: What Gets Imported

The table below describes the CSV import.

Use Cases

During QA cycles: The QA environment runs the Contrast agent while regression suites execute. At the end of each cycle the team reimports the export into a stable Test per application, so the security queue shows only what changed since the last cycle.

For DefectDojo Pro customers with many applications: The connector discovers every Contrast application in the organization, which makes it practical to map dozens of services to their Assets once and let findings flow on a schedule.

Correlating IAST with SAST: When a SAST tool flags a possible injection and Contrast confirms the same CWE at runtime on the same Asset, AppSec leads can raise its priority with evidence instead of guesswork.

Release gating: A pipeline step queries DefectDojo for active Critical and High Contrast findings on an Asset before promoting a build, while risk-accepted items with expiration dates stay out of the gate.

Operational Tips

• Endpoints from the CSV use 0.0.0.0 as the host. If several applications share an Asset, rely on the Asset and Test structure, not the endpoint host, to tell them apart.
• The description includes the Contrast status column. Changing a status in Contrast between exports changes the description, which is one of the default hashcode fields, so expect some churn if statuses move often.
• Keep the export scope consistent (same application, same filters) from one reimport to the next. A narrower export mitigates findings that simply fell outside the filter.
• Prefer the connector on DefectDojo Pro. It avoids manual exports and lets you set a minimum severity at the source.
• Set minimum_severity on CSV imports if Note-level findings, which arrive as Info, add noise.
• Tag imports with the environment the agent ran in (for example tags=qa,iast) so runtime findings can be filtered in metrics.