Horusec Integration with DefectDojo
Horusec is an open-source static application security testing (SAST) tool that orchestrates multiple security analyzers to identify vulnerabilities, security flaws, and exposed secrets across source code, configuration files, and Git history for over 20 programming languages including C#, Java, Python, Ruby, Go, JavaScript, TypeScript, PHP, Kotlin, and infrastructure as code formats like Terraform and Kubernetes. The platform provides customizable security scanning through CLI, IDE extensions, and CI/CD pipeline integration with detailed vulnerability reports, severity ratings, false positive management, and remediation recommendations to enable developers and DevSecOps teams to detect and address security issues throughout the software development lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from Horusec results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Horusec",
"engagement": "<engagement-id>",
"file": "results.json"
}