Deepfence ThreatMapper Integration with DefectDojo

Deepfence ThreatMapper Integration with DefectDojo

Deepfence ThreatMapper is an open source Cloud Native Application Protection Platform (CNAPP) developed by Deepfence and released under the Apache 2.0 license. Lightweight sensors run on hosts, as containers, or as a Kubernetes daemonset, and an agentless cloud scanner checks AWS, Azure, and GCP accounts through their APIs. ThreatMapper reports vulnerable packages, exposed secrets, malware matches, and compliance deviations against industry benchmarks, and its scan results can be exported as XLSX reports that DefectDojo imports.

Deepfence ThreatMapper Integration with DefectDojo

We run Deepfence ThreatMapper across our clusters and build hosts because it sees what is actually running, and we bring its reports into DefectDojo because that is where remediation gets assigned and measured. A ThreatMapper export is a long spreadsheet of rows for one scan type. Imported into DefectDojo, each row becomes a Finding on the Asset that owns the workload, deduplicated against earlier exports and held to the same SLAs as our code and dependency findings. Vulnerability, secret, malware, and compliance results all use one scan type, so the same pipeline handles every report ThreatMapper produces. On DefectDojo Pro, the ThreatMapper connector can also pull vulnerability scan results straight from the management console on a schedule.

Why Deepfence ThreatMapper Matters

Runtime environments drift from what was built. Packages get installed by hand, base images age, and configuration changes outside of version control.

• ThreatMapper scans live hosts, containers, and Kubernetes nodes, so it finds vulnerabilities in what is deployed rather than only in what was built.
• One platform covers four kinds of risk: CVEs in installed packages, secrets left in file systems, files matching malware rules, and compliance checks against benchmarks such as CIS.
• It is open source and self-hosted, which suits teams that keep workload data inside their own environment.
• Its console shows the state of the estate today, but it is not where most teams assign work, track SLAs, or report risk per application.

Advantages of This Integration

What we gained by routing ThreatMapper reports through DefectDojo:

• One import path for four report types. The parser reads the header row and decides whether the file holds vulnerability, secret, malware, or compliance results, so a single job can import every export.
• Deduplication across exports. DefectDojo hashes each finding on title, description, and severity, so importing next week's report doesn't duplicate everything that is still open.
• Lifecycle on reimport. Reimporting into the same Test mitigates findings that dropped out of the latest export, adds new ones, and reactivates any that returned.
• Runtime findings next to everything else. A CVE ThreatMapper sees on a production node can sit on the same Asset as the SCA and container image findings for that service, so remediation priorities come from one list.
• Ownership and ticketing. Findings can be assigned, commented on, risk-accepted with an expiry, or pushed to Jira like any other DefectDojo Finding.
• No exports for vulnerability data (DefectDojo Pro). The ThreatMapper connector discovers every scanned node and imports its latest completed vulnerability scan, so nobody has to generate and upload spreadsheets for CVE results.

How This Integration Works

DefectDojo imports ThreatMapper results with the Deepfence Threatmapper Report scan type. Only XLSX is supported. DefectDojo's sample data includes CSV copies of the same reports for reading in a browser, but the parser reads XLSX workbooks only.

1. Export a report from ThreatMapper. Generate a report for one scan type (vulnerability, secret, malware, or compliance) in XLSX format from the ThreatMapper console. The parser reads the first worksheet of the workbook and recognizes both the older column layout (for example cve_id and cve_attack_vector) and the newer one (for example CVE ID and Attack Vector).

2. Import it through the UI. Open the Engagement, choose Import Scan Results, select Deepfence Threatmapper Report, and upload the workbook.

3. Or automate it through the API. The API works the same way in Community Edition and DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Deepfence Threatmapper Report" \
  -F "file=@threatmapper-vulnerabilities.xlsx" \
  -F "product_name=prod-cluster-eu" \
  -F "engagement_name=Runtime Scans" \
  -F "test_title=ThreatMapper Vulnerabilities" \
  -F "auto_create_context=true"

4. Or use Universal Importer (DefectDojo Pro).

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Deepfence Threatmapper Report" \
  --report-path "./threatmapper-vulnerabilities.xlsx" \
  --product-name "prod-cluster-eu" \
  --engagement-name "Runtime Scans" \
  --auto-create-context

5. Keep report types in separate Tests. Because one scan type carries four kinds of report, give each its own Test (for example with test_title) and reimport each report type into its own Test. Reimporting a secrets report into the Test that holds vulnerabilities would mitigate every vulnerability finding.

Option: Deepfence ThreatMapper connector (DefectDojo Pro). The connector uses the ThreatMapper management console REST API and covers vulnerability scans only, so keep XLSX imports for secret, malware, and compliance reports. In the DefectDojo Pro UI, enter the console URL in Location (for example https://threatmapper.example.com) and your ThreatMapper API token (your user's API key under Settings > User Management) in Secret. Set Skip TLS Verification to true if the console uses a self-signed certificate, and optionally set a Minimum Severity. The connector exchanges the token for a short-lived access token on each sync.

Data Granularity: What Gets Imported

Because the description includes the node name, the same CVE on two different nodes produces two Findings, one per affected node.

Connector findings (DefectDojo Pro). The connector maps each scanned node (container image, host, or container) to a Record and each CVE in its latest completed vulnerability scan to a finding. It carries ThreatMapper's severity, the affected package, CVSS score, fix version as mitigation, reference links, and a details block. These findings are also dynamic and are de-duplicated on node, CVE, package, and package path.

Use Cases

Runtime vulnerability tracking for Kubernetes: A platform team exports ThreatMapper vulnerability results for each production cluster every week and reimports them into one Test per cluster. When a node pool is rebuilt on a patched image, the next reimport closes the CVEs that went away, and the Test history shows how long each one was open.

Secret exposure cleanup: Secrets found in container file systems are imported as their own Test, assigned to the owning team, and tracked to closure. Because the description records the rule, file, and node, the engineer knows where to look without logging into the ThreatMapper console.

Compliance evidence: CIS and similar benchmark checks land in DefectDojo with Fail mapped to High and Warn to Medium. Auditors can see which controls failed, when they were first reported, and when they were fixed.

Malware triage: Files that match ThreatMapper's malware rules arrive with the rule name and file path. Security analysts can mark false positives in DefectDojo, and those decisions persist across later imports of the same results.

Operational Tips

• Passing compliance checks are imported as Info findings. Set minimum_severity=Low on compliance imports if you only want failures and warnings.
• Only XLSX imports work. If someone hands you the CSV version of a report, open it in a spreadsheet tool and save it as XLSX first.
• Put each report type in its own Test and always reimport a report into the Test of the same type, so one report doesn't mitigate another report's findings.
• Dedupe hashes the description, which includes per-node details. If a node is renamed or replaced, expect its findings to close and reappear under the new node name.
• Tag imports with the cluster or environment (for example tags=prod,eu-west-1) so metrics can separate runtime findings by environment.
• If you adopt the connector for vulnerabilities, stop importing vulnerability XLSX exports for the same nodes so the two sources don't track the same CVEs twice.
• Every finding is marked dynamic. If your SLA policy or reports treat dynamic findings differently from static ones, account for ThreatMapper results in that category.