Endor Labs Integration with DefectDojo

Endor Labs Integration with DefectDojo

Endor Labs is a software composition analysis (SCA) platform built around reachability. Beyond listing the open source dependencies a project uses and the advisories that affect them, it analyzes whether the vulnerable function in a dependency is actually called by the project's code. Projects are organized into namespaces, scanned with the endorctl CLI or Endor's integrations, and findings are available through the Endor Labs REST API as JSON. DefectDojo can import a findings export as a file, and DefectDojo Pro can sync a whole namespace through a connector.

Endor Labs Integration with DefectDojo

We use Endor Labs because reachability cuts our dependency backlog down to what can actually be exploited in our code. DefectDojo is where that prioritized list turns into assigned work. Each Endor Labs finding lands on the right Asset with its reachability verdict front and center as the finding's impact, alongside the CVE and GHSA identifiers, CVSS, and Endor's remediation advice. Because the file parser and the connector use the same scan type and identity, we could start with exports and move to the connector later without creating a second copy of every finding.

Why Endor Labs Matters

Dependency scanners usually report every advisory for every package in the tree, and most of those vulnerable functions are never called.

• Function-level reachability separates vulnerabilities in code paths your application uses from those in code it never touches.
• Dependency-level reachability flags packages that are declared but not used at all.
• Endor grades its own findings, so severity reflects Endor's view rather than raw CVSS alone.
• Prioritizing by reachability only helps if the verdict follows the finding into triage, SLAs, and tickets. Otherwise engineers still see a flat list.

Advantages of This Integration

What we gained by sending Endor Labs findings through DefectDojo:

• Reachability where triagers look. The verdict (for example "Reachable (vulnerable function is called)") is set as the finding's Impact and added as a tag, so filters and rules can use it.
• One identity for file and API data. File imports and connector syncs both use the Endor Labs - Connectors Import scan type and the Endor finding UUID, so the two paths deduplicate against each other.
• Aliases on one Finding. The primary vulnerability ID and Endor's aliases are stored together, so a GHSA and its CVE both point to the same Finding.
• Lifecycle tracking. Reimports and connector syncs close findings Endor no longer reports and add new ones, so the Asset reflects the current dependency state.
• Shared workflow. Reachable findings can carry tighter SLAs, be assigned to owners, or be pushed to Jira, while unreachable ones are risk-accepted with an expiry.

How This Integration Works

Option 1: Endor Labs connector (DefectDojo Pro). The connector uses the Endor Labs REST API to sync an entire namespace. Create an API key in Endor Labs under Settings > Access > API Keys with read access to the namespace's projects and findings, then add the connector under Connect > Upstream:

1. Enter https://api.endorlabs.com in Location, or your region's API base URL.
2. Enter the Namespace to sync, for example your-org or your-org.team.
3. Enter the API Key identifier and the API Secret. The secret is exchanged for a short-lived bearer token and is not stored in cleartext.
4. Optionally set Traverse Child Namespaces to true and a Minimum Severity.

DefectDojo creates a Record for each Endor Labs project and imports its findings on each Sync.

Option 2: JSON file import (Community Edition and DefectDojo Pro). This path exists for teams that can't grant DefectDojo API credentials, such as air-gapped networks. Export findings as JSON from Endor's findings list endpoint. The parser accepts the API's list.objects envelope, a bare objects array, or a bare array of findings. With endorctl, for example:

endorctl api list --namespace your-org --resource Finding \
  --filter "spec.project_uuid==PROJECT_UUID" > endor-findings.json

Then upload the file in the UI (Import Scan Results, then Endor Labs - Connectors Import) or import it through the API:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Endor Labs - Connectors Import" \
  -F "file=@endor-findings.json" \
  -F "product_name=checkout-service" \
  -F "engagement_name=Dependencies" \
  -F "auto_create_context=true"

Data Granularity: What Gets Imported

The file parser mirrors the connector's conversion field for field.

Endor also reports secrets and other non-CVE findings. Those import without a CVE, score, or reachability verdict.

Use Cases

Reachability-driven SLAs: An AppSec team builds a rule or saved filter on the reachability tag, gives reachable Critical and High findings a short SLA, and risk-accepts unreachable ones with a 90-day expiry so they come back for review if the code changes.

Monorepos and many teams with DefectDojo Pro: A company with hundreds of Endor projects under one namespace enables the connector with child namespace traversal. Each project becomes a Record mapped to its owning team's Asset.

Air-gapped environments: A regulated team exports findings with endorctl inside the restricted network and imports the file through the API. If the connector is approved later, findings keep their identity and don't double.

Consolidating SCA: Organizations moving from another SCA tool can run both side by side in DefectDojo and compare results per Asset before deciding which to keep.

Operational Tips

• Filter on reachability early. Unreachable findings still import, so decide whether they belong in your default views and SLA reports.
• If you switch from file imports to the connector, keep the same Asset mapping so the shared scan type and UUIDs deduplicate as intended.
• Use the connector's Minimum Severity or the API's minimum_severity to keep Info-level findings out when they aren't useful.
• Findings that arrive without an Endor UUID use a composite ID built from the vulnerability and component version. An upgrade changes that ID, so expect the old finding to close and a new one to open.
• Secrets and other non-vulnerability findings come through the same scan type. Use Endor's category tags to separate them in reports.
• Run endorctl exports per project with a filter so each file maps cleanly to one DefectDojo Asset.