Edgescan Integration with DefectDojo

Edgescan Integration with DefectDojo

Edgescan is a SaaS security testing platform from Edgescan, a company based in Dublin, Ireland. It combines continuous automated scanning of web applications, APIs, and network infrastructure with manual validation by Edgescan's security analysts, so vulnerabilities are checked by a person before they reach the customer. Edgescan organizes results by asset, rates each vulnerability on a numeric severity scale from 1 to 5, and exposes them through a REST API that returns JSON. DefectDojo can import that JSON as a file, and DefectDojo Pro can pull it directly with a connector.

Edgescan Integration with DefectDojo

We pay for Edgescan because its findings arrive validated, which means our engineers don't spend their week disproving false positives. The work starts after that: assigning each vulnerability, tracking it against our SLAs, and showing it next to what our SAST and SCA tools report for the same application. Bringing Edgescan results into DefectDojo puts every validated vulnerability on the Asset that owns the application or host, keeps Edgescan's open or closed status, and gives us one place to report remediation progress.

Why Edgescan Matters

External testing finds what the outside world can reach, and validated results are cheaper to act on than raw scanner output.

• Edgescan covers web applications, APIs, and network-facing hosts, which is the part of the attack surface an attacker sees first.
• Human validation filters out false positives before results are delivered.
• Results include CWE and CVE references and, where available, CVSS vectors, which helps prioritization.
• Continuous testing produces a steady stream of results, and that stream needs ownership and deadlines to turn into fixes.

Advantages of This Integration

What we gained by routing Edgescan results through DefectDojo:

• Exact deduplication. DefectDojo deduplicates Edgescan findings on Edgescan's own vulnerability ID, so pulling the same vulnerability again updates the existing finding rather than adding a copy.
• Status carried over. Vulnerabilities open in Edgescan arrive active, and closed ones arrive inactive.
• Tags from Edgescan. Edgescan asset tags are copied onto each finding, so tags like environment or business unit carry into DefectDojo filters and metrics.
• SLAs on a familiar scale. Edgescan's 1 to 5 severity maps to Info through Critical, so the same SLA rules apply as for every other scanner.
• Endpoints for external findings. The vulnerable location is recorded as an endpoint, so findings can be grouped by host or URL.
• Jira and assignment. Findings can be assigned to owners and pushed to Jira with Edgescan's description and remediation text attached.

How This Integration Works

DefectDojo uses the Edgescan Scan scan type for Edgescan results. There are two supported paths.

Option 1: JSON file import (Community Edition and DefectDojo Pro). The parser expects a JSON array of Edgescan vulnerability objects, as returned by the Edgescan vulnerability export API.

Request the JSON vulnerabilities export (/api/v1/vulnerabilities/export.json) from the Edgescan API, filtered to open vulnerabilities and authenticated with your Edgescan API token in the X-API-TOKEN header, and save the response as edgescan.json.

The export can also be filtered to specific Edgescan assets. Then import the file in the UI (Engagement, Import Scan Results, Edgescan Scan) or through the API:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Edgescan Scan" \
  -F "file=@edgescan.json" \
  -F "product_name=customer-portal" \
  -F "engagement_name=Edgescan" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Edgescan Scan" \
  --report-path "./edgescan.json" \
  --product-name "customer-portal" \
  --engagement-name "Edgescan" \
  --auto-create-context

Option 2: Edgescan connector (DefectDojo Pro). The connector uses the Edgescan REST API to import open vulnerabilities across your whole Edgescan account. Create an API token in Edgescan under Account settings > API tokens (a dedicated account for the connector keeps automated activity easy to identify). In the connector, enter https://live.edgescan.com (or your tenant's host) as the Location and the token as the Secret, and optionally set a Minimum Severity. DefectDojo enumerates every Edgescan asset, creates a Record for each, and imports that asset's open vulnerabilities, with no per-asset setup.

A note on the older API pull. The Edgescan API import configured through Tool Configuration and an API Scan Configuration is deprecated as of DefectDojo 3.2.0 and scheduled for removal in 3.5.0 (November 2026). Migrate those setups to the connector or to JSON file import, which is not affected.

Data Granularity: What Gets Imported

Use Cases

Continuous external testing: A team with Edgescan monitoring its public applications runs the DefectDojo Pro connector so newly validated vulnerabilities arrive on a schedule and closed ones drop off without anyone exporting files.

Combining inside-out and outside-in results: Edgescan findings for a web application sit on the same Asset as its SAST and SCA findings, so an AppSec lead can see whether an externally confirmed injection flaw was also flagged in code.

Reporting by business unit: Teams that tag Edgescan assets by environment or business unit get those tags on every finding, which makes per-unit SLA reports in DefectDojo a filter rather than a spreadsheet exercise.

Network and host exposure: Infrastructure vulnerabilities from Edgescan network testing land with the host as an endpoint, so the infrastructure team can work them by host alongside findings from internal scanners.

Operational Tips

• Export per Edgescan asset (with c[asset_id_in]) and import each into the matching DefectDojo Asset. A single account-wide export puts every Edgescan asset's findings on one Asset.
• Because deduplication uses Edgescan's vulnerability ID, reimport is reliable. Reimport each new export into the same Test so vulnerabilities missing from the new file are mitigated.
• If you export with c[status]=open, closed vulnerabilities will simply be absent; rely on reimport to close them. If you export all statuses, closed ones arrive inactive.
• CVSS vectors are only stored for CVSS v3. Findings scored with older CVSS versions rely on Edgescan's 1 to 5 severity alone.
• Migrate any Tool Configuration based Edgescan imports before the 3.5.0 release removes them.
• On DefectDojo Pro, set the connector's Minimum Severity to match the levels your team actually works, rather than filtering after import.