Harbor Vulnerability Integration with DefectDojo

Harbor Vulnerability Integration with DefectDojo

Harbor is an open source container registry and a graduated project of the Cloud Native Computing Foundation (CNCF), originally developed at VMware. Alongside storing and signing images, it can scan every artifact for vulnerabilities through a pluggable scanner interface, with Trivy as the default scanner. Scan results are shown in the Harbor UI and are available as JSON from the Harbor API. DefectDojo imports that vulnerability report JSON, as well as the JSON output of the harborapi Python client.

Harbor Vulnerability Integration with DefectDojo

Harbor already scans every image we push, so its results were the obvious source for container CVEs. The registry is good at telling you what is wrong with one artifact. It doesn't assign that work, measure how long it stays open, or show it next to the rest of an application's findings. Importing Harbor vulnerability reports into DefectDojo turns each package CVE into a Finding with a fix version and an owner, on the Asset that runs the image, and each rescan updates them. On DefectDojo Pro, the Harbor connector removes the export step entirely by syncing every scanned artifact in the registry on a schedule.

Why Harbor Vulnerability Scanning Matters

The registry is the last checkpoint before an image runs, which makes it a natural place to measure what you are about to deploy.

• Harbor can scan on push, so every image gets results without changes to individual build pipelines.
• The scanner interface lets you use Trivy or another supported scanner while keeping the same report format.
• Each vulnerability names the package, the installed version, and the fixed version when one exists.
• Harbor can block pulls of images above a severity threshold, which pairs well with tracking what is still open.
• Results stay with the artifact in the registry. Trends, SLAs, and ownership across images and teams need a separate platform.

Advantages of This Integration

What we gained by sending Harbor scan results through DefectDojo:

• Fix-ready findings. When Harbor reports a fixed version, DefectDojo records "Upgrade package to version X" as the mitigation and sets the fix available flag, so filtering for fixable CVEs is one click.
• Deduplication. DefectDojo hashes each finding on title and mitigation, and the title already includes the CVE, package, and installed version.
• Lifecycle across rescans. Reimporting a newer report for the same image into the same Test mitigates CVEs fixed by a rebuild and reactivates any that return.
• SLAs. Harbor's Low through Critical severities carry over unchanged, so image CVEs fall under the same SLA rules as findings from other tools.
• Ownership by application. Importing each image's report into the Asset that deploys it puts container CVEs in front of the team that can rebuild the image.
• Registry-wide sync (DefectDojo Pro). The Harbor connector enumerates every project, repository, and scanned artifact through the Harbor v2.0 API, with no per-image configuration.

How This Integration Works

DefectDojo imports Harbor results with the Harbor Vulnerability Scan scan type. The parser accepts two layouts: the Harbor API's vulnerability report, which nests the vulnerabilities list under a report MIME type key, and the harborapi client's JSON, which has vulnerabilities at the top level.

1. Get the vulnerability report for an artifact. From the Harbor API (v2.0), request the vulnerabilities addition for an image tag or digest. The path follows the pattern /api/v2.0/projects/<project>/repositories/<repository>/artifacts/<tag or digest>/additions/vulnerabilities, authenticated with a Harbor user or robot account, and the response body is the JSON file to save as harbor-report.json.

The image must have been scanned in Harbor first, either on push or by a manual or scheduled scan.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select Harbor Vulnerability Scan, and upload the file. To automate (Community Edition and DefectDojo Pro):

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Harbor Vulnerability Scan" \
  -F "file=@harbor-report.json" \
  -F "product_name=payments-api" \
  -F "engagement_name=Registry Scans" \
  -F "test_title=payments/api" \
  -F "auto_create_context=true"

DefectDojo Pro users can use Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Harbor Vulnerability Scan" \
  --report-path "./harbor-report.json" \
  --product-name "payments-api" \
  --engagement-name "Registry Scans" \
  --auto-create-context

3. Reimport on each new tag. When a new tag of the same image is scanned, send its report to /api/v2/reimport-scan/ against the same Test so the history for that image stays in one place.

Option: Harbor connector (DefectDojo Pro). Configure the connector in the DefectDojo Pro UI instead of fetching reports per image. Create a Harbor account, ideally a dedicated robot account with pull permission on repositories and artifacts. Enter the Harbor URL in Location (for example https://harbor.example.com; DefectDojo appends /api/v2.0), the username or robot account name exactly as Harbor shows it (robot$<name> by default) in Username, and the password or robot secret in Secret (sent with HTTP Basic authentication). Optionally set a Minimum Severity. Each Harbor project becomes a Record, and the vulnerabilities of every scanned artifact are imported with the image (repository plus tag or digest) as finding context.

Data Granularity: What Gets Imported

Within one report, entries with the same title are imported once. The report does not identify the image inside each finding, so the Test (or its title) is what ties findings to an image.

Connector findings (DefectDojo Pro). The connector maps each Harbor project to a Record and imports, where Harbor provides them, the affected package and version, a CVSS-derived severity, the CVE, the CWE, and a remediation (fixed version). Unlike file imports, it carries the image repository and tag or digest as finding context.

Use Cases

For registry-wide visibility: A platform team pulls the vulnerability report for the current production tag of every image nightly and reimports each into its owning Asset. Security leads get open container CVEs by team, with ages, instead of browsing the registry project by project.

Before promotion to production: A release job fetches the Harbor report for the candidate tag and imports it. The job checks DefectDojo for active Critical findings that aren't risk-accepted before promoting the image.

When a base image is patched: After rebuilding images on a new base, reimporting their reports shows which CVEs the rebuild closed across every service and which remain because they come from application-installed packages.

For non-fixable CVEs: Findings without a fix version are easy to filter in DefectDojo. Teams risk-accept them with an expiry date so they come back for review once a fix is likely.

Operational Tips

• Use one Test per image repository and reimport into it. Since findings don't carry the image name, mixing images in one Test makes reimport mitigate findings that belong to another image.
• Expect new findings when a fix becomes available. Mitigation is part of the deduplication hash, so a CVE that gains a fixed version on rescan is imported as a new finding and the old one is mitigated.
• Upgrading a package also produces a new title, since the installed version is in it. That's the intended lifecycle: the old finding closes and any remaining issue shows the new version.
• Negligible and Unknown severities import as Info. Set minimum_severity=Low if those would crowd the queue.
• Make sure Harbor has a completed scan for the artifact before fetching the report. A report without a vulnerabilities list imports as zero findings, so reimporting one fetched too early would close every open finding for the image.
• The connector only imports artifacts with a completed scan. Trigger a scan in Harbor for images that have never been scanned, or they won't appear.
• Tag imports with the image tag (for example tags=1.8.0) so you can trace findings to a release.