Endor Labs Integration with DefectDojo
Endor Labs is an application security platform focused on software composition analysis (SCA), providing reachability-based vulnerability prioritization for open source dependencies. Unlike traditional SCA tools that flag every known CVE in a dependency tree, Endor Labs determines whether vulnerable code is actually reachable and callable from an application, cutting through noise to surface the risks that matter. The platform also scores dependencies on activity, quality, popularity, and security, and detects malicious or typosquatted packages across direct and transitive dependencies. Security and engineering teams use Endor Labs to reduce false positives, prioritize remediation, and secure their open source software supply chain across ecosystems including npm, Maven, PyPI, and more.
Data Granularity: What Gets Imported
The following fields are captured from Endor Labs results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Endor Labs",
"engagement": "<engagement-id>",
"file": "results.json"
}