DawnScanner Integration with DefectDojo
DawnScanner is an open-source static application security testing (SAST) tool designed specifically for Ruby web applications that automatically scans source code to identify security vulnerabilities including CVE-listed flaws, OWASP risks, cross-site scripting (XSS), SQL injection, and insecure gem dependencies across Ruby on Rails, Sinatra, and Padrino frameworks. The tool analyzes project Gemfile.lock files, Ruby interpreter versions, and application code including views to detect security issues with over 680 security checks in its knowledge base, providing developers with mitigation guidance to strengthen application security before deployment.
Data Granularity: What Gets Imported
The following fields are captured from DawnScanner results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "DawnScanner",
"engagement": "<engagement-id>",
"file": "results.json"
}