Docker Integration with DefectDojo
Docker Bench for Security is an open-source automated security auditing script developed by Docker that checks Docker host configurations and container deployments against dozens of common best practices defined in the CIS Docker Benchmark to identify security misconfigurations, weak permissions, and insecure defaults in production environments. The tool performs comprehensive assessments across host configuration, Docker daemon settings, container images, runtime configurations, and Docker security operations to help organizations harden their Docker infrastructure and improve overall container security posture.
Data Granularity: What Gets Imported
The following fields are captured from Docker results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Docker",
"engagement": "<engagement-id>",
"file": "results.json"
}