DSOP Integration with DefectDojo

DSOP Integration with DefectDojo

DSOP is the name used for the U.S. Department of Defense DevSecOps container hardening pipelines associated with Platform One's Iron Bank, the DoD's repository of hardened container images, whose pipeline projects are hosted under the dsop group on Platform One's Repo One. These pipelines scan each candidate image with several tools and collect the results in an Excel (XLSX) workbook: OpenSCAP compliance checks against the DISA profile, OpenSCAP OVAL vulnerability definitions, Twistlock (now Palo Alto Networks Prisma Cloud Compute) vulnerability results, and Anchore CVE and compliance results. DefectDojo's DSOP Scan parser reads that workbook, sheet by sheet.

DSOP Integration with DefectDojo

When we harden images for a DoD environment, the pipeline gives us one workbook with five tabs of results and a deadline. Working the spreadsheet by hand means copying rows into tickets and losing track of what was justified in the last round. Importing the DSOP workbook into DefectDojo splits it into Findings on the Asset for that image, tags each one with the tool it came from, and lets us track remediation and justifications across pipeline runs.

Why DSOP Matters

Hardened container programs ask for evidence from more than one scanner, and the DSOP workbook is where that evidence lands.

• It combines configuration compliance (OpenSCAP against the DISA profile) with vulnerability results from three different engines in one file.
• Each tool sees different things: OVAL definitions follow distribution advisories, Twistlock and Anchore match packages against their own vulnerability feeds, and Anchore compliance applies DoD file checks.
• Teams going through image accreditation need to fix or justify every relevant finding, which is tracking work, not just scanning.
• A spreadsheet per run has no memory, so repeated pipeline runs make it hard to see what changed.

Advantages of This Integration

What we gained by importing DSOP workbooks into DefectDojo:

• One import, five sources. A single upload produces findings from all five sheets, each tagged disa, oval, twistlock, anchore, or anchore_compliance so they can be filtered by origin.
• Only actionable rows. DISA compliance rows are imported only when the result is fail or notchecked, OVAL rows only when the definition evaluated true, and Anchore compliance rows only for the DoDFileChecks policy.
• Justifications live with the finding. Notes, risk acceptance with expiry, and false positive marking give each finding a record of why it was accepted, which carries forward on reimport.
• Run-to-run history. Reimporting the next pipeline run into the same Test mitigates findings that disappeared and adds new ones.
• Ownership and SLAs. Findings can be assigned to the image maintainer, pushed to Jira, and measured against SLA targets by severity.

How This Integration Works

DefectDojo imports the workbook with the DSOP Scan scan type.

1. Get the workbook. Download the XLSX results workbook produced by your DSOP pipeline run. The parser expects all five sheets, with these exact names: OpenSCAP - DISA Compliance, OpenSCAP - OVAL Results, Twistlock Vulnerability Results, Anchore CVE Results, and Anchore Compliance Results. Each sheet's first row must hold the column headers.

2. Import it. In the UI, open the Engagement for the image, choose Import Scan Results, select DSOP Scan, and upload the file. To automate, use the import API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=DSOP Scan" \
  -F "file=@dsop-results.xlsx" \
  -F "product_name=hardened-nginx" \
  -F "engagement_name=Iron Bank Hardening" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "DSOP Scan" \
  --report-path "./dsop-results.xlsx" \
  --product-name "hardened-nginx" \
  --engagement-name "Iron Bank Hardening" \
  --auto-create-context

3. Reimport each run. Send the workbook from later pipeline runs to /api/v2/reimport-scan/ against the same Test.

Data Granularity: What Gets Imported

Use Cases

During image accreditation: A team hardening a base image imports each pipeline run, works the open findings by owner, and records justifications for the ones that can't be fixed, so the next submission starts from the last decision instead of a fresh spreadsheet.

Comparing scanners: Because each finding carries a tag for its source sheet, the team can filter Twistlock and Anchore results side by side and see where the two engines disagree about a package.

Tracking many hardened images: A program office maintaining dozens of images imports each into its own Asset, which gives a single report of open Critical and High findings across the portfolio.

Separating compliance from vulnerabilities: Filtering by the disa and anchore_compliance tags gives the configuration and file-check work, while oval, twistlock, and anchore give the package vulnerability work, which often belong to different people.

Operational Tips

• Don't rename or drop sheets. The parser looks up all five sheets by name, and a workbook missing one will not import.
• Deduplication uses vulnerability IDs alone. The same CVE reported on both the Twistlock and Anchore sheets, or in two packages, can be marked as duplicates, and rows without an ID (such as Anchore compliance results) give the hashcode little to distinguish. Review duplicates before closing anything.
• Anchore CVE severity is copied from the sheet as written, so check that the values use DefectDojo's names (Critical, High, Medium, Low, Info) before relying on SLAs.
• Anchore compliance findings all get the mitigation "To be investigated". Replace it with the real fix during triage.
• Use risk acceptance with an expiration date for justified findings, so they come back for review at the next accreditation cycle.
• Import each image into its own Asset, or its own Engagement with deduplication_on_engagement=true, so the results of one image don't deduplicate against another.