CycloneDX Integration with DefectDojo
CycloneDX is an OWASP full-stack Bill of Materials (BOM) standard that provides a lightweight, machine-readable format for documenting software components, dependencies, services, and vulnerabilities across the entire software supply chain, supporting multiple BOM types including Software Bill of Materials (SBOM), Software-as-a-Service BOM (SaaSBOM), Hardware BOM (HBOM), Cryptography BOM (CBOM), and Vulnerability Disclosure Reports (VDR). The specification enables organizations to achieve transparency in their software ecosystems by representing comprehensive inventories that facilitate rapid identification of vulnerabilities, licensing conflicts, outdated components, and supply chain risks Nexpose while integrating seamlessly with vulnerability management systems and compliance frameworks.
Data Granularity: What Gets Imported
The following fields are captured from CycloneDX results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "CycloneDX",
"engagement": "<engagement-id>",
"file": "results.json"
}