Cyberwatch Integration with DefectDojo

Cyberwatch Integration with DefectDojo

Cyberwatch is a vulnerability management and compliance platform from the French company of the same name. It inventories the assets in an environment, identifies the CVEs that affect them, and reports security issues such as compliance and configuration checks, enriched with CVSS scores, EPSS probabilities, and exploit maturity. Cyberwatch is typically run as an appliance with an API. DefectDojo imports Cyberwatch data from a JSON file produced by Cyberwatch-API-DefectDojo, an export script published on GitHub by Galeax, and DefectDojo Pro adds a Cyberwatch connector that reads the appliance directly.

Cyberwatch Integration with DefectDojo

We use Cyberwatch to tell us which of our servers carry which CVEs, and DefectDojo to make sure the right team fixes them. The Galeax script pulls CVEs and security issues for a Cyberwatch group, and DefectDojo turns each one into a Finding with its CVSS vector, EPSS score, CWE, and the affected hosts as endpoints. Infrastructure vulnerabilities then follow the same SLA policy as application findings, and reports for an Asset show both. On DefectDojo Pro, the Cyberwatch connector can replace the export script and sync CVEs and compliance issues on a schedule.

Why Cyberwatch Matters

Infrastructure vulnerability data is only useful when it is tied to specific hosts and prioritized by more than raw CVSS.

• Cyberwatch reports the hosts each CVE affects, so remediation can be scoped to real machines.
• EPSS and exploit code maturity show which CVEs are likely to be exploited, which is more useful for ordering work than severity alone.
• Each CVE comes with its CWE, related CAPEC attack patterns, and MITRE ATT&CK techniques, which helps when explaining risk to non-specialists.
• Security issues cover checks that are not CVEs, so configuration and compliance gaps show up next to software vulnerabilities.

Advantages of This Integration

What running Cyberwatch data through DefectDojo gives us:

• One Finding per CVE, with all affected hosts. The parser groups entries by CVE code and attaches every affected server as an endpoint, instead of producing one Finding per host.
• Prioritization fields in place. CVSS v3 vector and score, EPSS score, and all CWEs are stored in DefectDojo fields, so you can filter and sort on them.
• Status carried over. A Finding is active if any affected server is still active in Cyberwatch, and mitigated when none are.
• Security issues tracked too. Each Cyberwatch security issue becomes a Finding with its own severity, affected hosts, and related CVE announcements.
• Direct sync with DefectDojo Pro. The Cyberwatch connector pulls CVEs and security (compliance) issues from the appliance in a single sync and creates a Record for each server Cyberwatch knows about.
• Shared SLAs and reporting. Infrastructure Findings sit on the same Assets as application results, under one SLA configuration, with assignment and Jira push available for both.

How This Integration Works

DefectDojo imports this data with the Cyberwatch scan (Galeax) scan type. The file is a JSON document with two keys: cves, a list of CVE entries, and security_issues, a list of security issue entries.

1. Export from Cyberwatch. Clone the Cyberwatch-API-DefectDojo repository, create an api.conf from the included example_api.conf with your Cyberwatch API details, and run the script:

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
python3 get_cves_security_issues.py

The script asks for a Cyberwatch group name and writes a JSON file with all CVEs and security issues, active and inactive, for the assets in that group.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select Cyberwatch scan (Galeax), and upload the JSON. To automate it, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Cyberwatch scan (Galeax)" \
  -F "file=@cyberwatch-export.json" \
  -F "product_name=datacenter-linux" \
  -F "engagement_name=Infrastructure" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Cyberwatch scan (Galeax)" \
  --report-path "./cyberwatch-export.json" \
  --product-name "datacenter-linux" \
  --engagement-name "Infrastructure" \
  --auto-create-context

3. Reimport on a schedule. Run the export and reimport into the same Test on a regular cadence so DefectDojo reflects the current state of the group.

Option: Cyberwatch connector (DefectDojo Pro). To skip the export script, configure the Cyberwatch connector in the DefectDojo Pro UI. Create an API key ID and secret key in the appliance under Profile > API keys. Enter your Cyberwatch appliance URL in the Location field, the API key ID in the API Key field, and the secret in the Secret Key field. Optionally set a Minimum Severity to limit which findings are imported. Each server becomes a Record that you map to an Asset, and the connector syncs on a schedule.

Data Granularity: What Gets Imported

The table above describes the Galeax file parser. With the DefectDojo Pro connector, each Cyberwatch asset (server) becomes a Record carrying both its CVEs and its compliance findings.

Use Cases

Patch management follow-up: An infrastructure team exports its production Linux group weekly and reimports it. CVEs that patching removed are mitigated, new ones get assigned, and the team lead sees the open count trend down release by release.

Exploit-driven prioritization: A security analyst filters Cyberwatch Findings by EPSS score and Critical severity to build the short list for this week's emergency patch window, then pushes it to Jira.

Combined risk view: An application Asset holds SAST and dependency findings from the build pipeline and Cyberwatch Findings for the servers that run it, so the owner sees code and host risk in one report.

Compliance tracking: Cyberwatch security issues land as Findings with their own severities, so configuration gaps can be assigned, risk-accepted with expiry dates, and reported on during audits.

Operational Tips

• Import one Cyberwatch group per Asset (or per Engagement) so ownership in DefectDojo matches how assets are grouped in Cyberwatch.
• CVE entries without product update data are imported as already mitigated. If you expect active Findings and see none, check whether your export includes updates_assets.
• Test a real export in a staging Asset before automating. The sample files in the DefectDojo repository don't include product update data, so that path has less coverage.
• EPSS and exploit maturity are part of the description, and the description is part of the hash. When those values change between exports, DefectDojo may treat the CVE as a new Finding. Review duplicates after the first few reimports.
• When several CVEs affect the same product version, the parser shows that version only on the highest-severity Finding for the product, so don't read a blank component version as "unknown".
• With the DefectDojo Pro connector, records are per server rather than per group, so map Records to Assets in a way that matches server ownership. The connector's secret key is never logged.
• Use minimum_severity to keep Info-level security issues out of the queue if they're mostly informational checks.