Harbor Vulnerability Integration with DefectDojo
Harbor Vulnerability Scanning is a built-in security feature within Harbor, the open-source cloud-native container registry, that performs static analysis of container images to identify security vulnerabilities and compliance issues by integrating with pluggable vulnerability scanners including Trivy, Clair, and other third-party scanning solutions. The platform automatically scans container images at configurable intervals or on-demand, generates detailed vulnerability reports with severity ratings and CVE references, and enables deployment security policies that prevent images exceeding specified vulnerability thresholds from being pulled, helping organizations strengthen their software supply chain security before containers reach production environments.
Data Granularity: What Gets Imported
The following fields are captured from Harbor Vulnerability results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Harbor Vulnerability",
"engagement": "<engagement-id>",
"file": "results.json"
}