HCL AppScan Integration with DefectDojo

HCL AppScan Integration with DefectDojo

HCL AppScan is an application security testing product family from HCLSoftware, which took over the line from IBM (it was previously sold as IBM Security AppScan). AppScan on Cloud is the SaaS edition, and it runs dynamic scans against live web applications and APIs as well as static analysis of source code. Results can be exported from the portal as PDF, XML, or CSV. DefectDojo reads the XML export and has two parsers for it: one for dynamic (DAST) results and one for AppScan on Cloud static (SAST) results. AppScan on Cloud and the self-hosted AppScan 360° share the AppScan v4 REST API, which the DefectDojo Pro connector uses.

HCL AppScan Integration with DefectDojo

We use HCL AppScan to test our web applications, and DefectDojo is where those results get owned and closed. The AppScan portal is good at showing what one scan found. It is less helpful when the same application also has SCA, container, and pentest findings, and leadership wants one answer about exposure. Importing the AppScan XML into DefectDojo puts every issue on the right Asset, deduplicates it against earlier scans, and gives it an SLA, an owner, and a history that survives the next scan cycle. On DefectDojo Pro, the HCL AppScan connector skips the export step entirely and syncs every application in the account.

Why HCL AppScan Matters

AppScan covers both sides of application testing, which is why it shows up in a lot of enterprise AppSec programs.

• Dynamic scans exercise a running application over HTTP, so they catch issues that only appear at runtime, such as missing security headers, injection points, and weak session handling.
• Static scans on AppScan on Cloud point to the source file and line, along with a call trace, which tells a developer exactly where to look.
• Each issue carries a CWE, a threat classification, and fix guidance, so findings arrive with context rather than just a name.
• On its own, an export is a point-in-time list. Without a platform tracking it, it is hard to tell which issues are new, which were fixed, and which keep coming back.

Advantages of This Integration

What we gained by sending AppScan results through DefectDojo:

• Deduplication you can predict. DAST findings are hashed on title and description. SAST findings are hashed on title, file path, line, and severity, so the same flaw in the same place is recognized on the next import.
• Lifecycle on reimport. Reimporting a newer export into the same Test mitigates issues that are gone, adds new ones, and reactivates any that regressed.
• SLAs and ownership. AppScan severities map onto DefectDojo's Critical through Info scale, so issues fall under the same SLA rules as findings from every other tool, and each can be assigned, commented on, or pushed to Jira.
• Static and dynamic in one place. DAST findings are flagged dynamic and SAST findings static, so they can be filtered separately while still rolling up to one Asset.
• Account-wide sync on DefectDojo Pro. The HCL AppScan connector discovers every AppScan application, creates a Record for each, and imports its DAST, SAST, and IAST issues, so new applications are picked up without a new pipeline job.
• Risk decisions that stick. Reimport matches incoming issues to existing findings, so risk acceptance and false positive decisions carry forward and the same issue doesn't need to be argued over every scan.

How This Integration Works

DefectDojo has two scan types for AppScan XML. Pick the one that matches the scan that produced the file.

• HCLAppScan XML for dynamic (DAST) scan results.
• HCL AppScan on Cloud SAST XML for static analysis results from AppScan on Cloud.

Both parsers check that the root element is an AppScan xml-report and read issues from its issue-group section, so other export formats (PDF, CSV) will not import.

1. Export the report. In AppScan on Cloud, generate a report for the scan or application and choose XML as the format. Keep DAST and SAST exports as separate files.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select the matching scan type, and upload the XML. To automate, use the API, available in Community Edition and DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=HCLAppScan XML" \
  -F "file=@appscan-dast.xml" \
  -F "product_name=customer-portal" \
  -F "engagement_name=AppScan DAST" \
  -F "auto_create_context=true"

For static results, change the scan type and file:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=HCL AppScan on Cloud SAST XML" \
  -F "file=@appscan-sast.xml" \
  -F "product_name=customer-portal" \
  -F "engagement_name=AppScan SAST" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import from a pipeline with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "HCL AppScan on Cloud SAST XML" \
  --report-path "./appscan-sast.xml" \
  --product-name "customer-portal" \
  --engagement-name "AppScan SAST" \
  --auto-create-context

3. Reimport on a schedule. When the next scan of the same application finishes, send its export to /api/v2/reimport-scan/ against the same Test so fixed issues are closed and history stays in one place.

Option: HCL AppScan connector (DefectDojo Pro). The connector calls the AppScan v4 REST API for AppScan on Cloud or a self-hosted AppScan 360°. Generate an AppScan API key (Key ID and Key Secret) under your AppScan account settings, then fill in the connector:

• Location: https://cloud.appscan.com for AppScan on Cloud, https://eu.cloud.appscan.com for the EU region, or your AppScan 360° host.
• Provider: ASOC for AppScan on Cloud, A360 for AppScan 360°.
• API Key ID and API Key Secret: exchanged for a short-lived session token on each run and never logged.
• Minimum Severity (optional): limits which findings are imported.

DefectDojo maps each AppScan application to a Record and each issue to a finding.

Data Granularity: What Gets Imported

The DefectDojo Pro connector maps API issues along the same lines: the title is the issue type with domain, entity, cause ID, URL, and path appended; Informational becomes Info while Low through Critical pass through; CWE, a labeled description, remediation and advisory, and the host and port endpoint carry over. Static analysis issues are recorded as static findings and dynamic or interactive (IAST) issues as dynamic. Open issues are active, and fixed or passed issues are mitigated.

Use Cases

For a recurring DAST program: The security team scans each customer-facing application monthly, exports the XML, and reimports into one Test per application. Engineers see what is new since last month, and fixed issues close without anyone editing them.

For static analysis in development: Teams running AppScan on Cloud static scans import results into the same Asset as their dynamic findings. Developers get file and line details with a call trace, while AppSec leads see code-level and runtime issues for the application together.

When consolidating tools: An organization with AppScan for application testing and other scanners for dependencies and containers uses DefectDojo to report on all of them per Asset and per Organization, instead of pulling separate exports from each portal.

For audit evidence: Each AppScan issue in DefectDojo carries a discovery date, SLA status, owner, and closure date, which is the trail auditors ask for when they review web application testing.

Operational Tips

• Use the right scan type for the right export. A DAST file imported as SAST (or the reverse) will produce wrong titles and miss file or endpoint details.
• Keep DAST and SAST in separate Tests, ideally separate Engagements, so reimports of one never mitigate findings from the other.
• DAST deduplication includes the full description, so changes to issue wording between AppScan versions can create new findings. Expect some churn after a product upgrade and close duplicates in bulk.
• SAST deduplication includes the line number. Code that moves can show up as a new finding at the new line and a mitigated one at the old line on reimport.
• Check the severities after your first SAST import. The SAST parser passes the report's severity through, so confirm your exports use High, Medium, Low, or Critical.
• With the connector, AppScan's own issue status drives the lifecycle: fixing or passing an issue in AppScan mitigates it in DefectDojo on the next sync. Use the connector's Minimum Severity field rather than filtering after the fact.
• Don't run the connector and XML imports for the same application, or you will track the same issues in two places.
• Set minimum_severity on import if informational DAST results add noise, and tag imports with the scan date or release (for example tags=appscan,2026-10) for filtering in metrics.