IBM AppScan Integration with DefectDojo

IBM AppScan Integration with DefectDojo

IBM AppScan is a dynamic application security testing (DAST) product line that IBM sold to HCL in 2019; it continues today as HCL AppScan from HCLSoftware. AppScan Standard, the desktop scanner, crawls a running web application, sends test requests, and reports issues such as injection flaws, cross-site scripting, and insecure configuration, grouped by issue type with advisories and fix recommendations. Reports can be exported in several formats, including the XML layout that DefectDojo's IBM AppScan DAST parser reads.

IBM AppScan Integration with DefectDojo

We kept AppScan in our program because it is thorough on authenticated web scans and our application owners were already used to its advisories. What we lacked was memory. Each AppScan report stood alone, and comparing this quarter's scan against last quarter's meant reading two documents side by side. Importing the XML into DefectDojo puts every issue type on the Asset that owns the application, with its CWE, affected URL, and AppScan's fix recommendation, and lets the next scan close what was fixed.

Why IBM AppScan Matters

Static analysis tells you what the code might do. A DAST scanner tells you what the running application actually does when it receives hostile input, including issues introduced by configuration, frameworks, and infrastructure in front of the code.

• AppScan tests the deployed application, so it finds problems that only exist at runtime, such as missing security headers or exposed debug pages.
• Its advisories explain each issue type in technical terms, and its fix recommendations give developers a starting point.
• Issues carry CWE identifiers, which makes them comparable with findings from other scanners.
• Without a central platform, DAST reports become point-in-time documents with no owner, no SLA, and no history.

Advantages of This Integration

What we gained by importing AppScan reports into DefectDojo:

• Findings consolidated by issue type. The parser merges repeated occurrences of the same issue name, description, and severity into one finding, which keeps a large crawl from producing hundreds of near-identical entries.
• CWE and CVE context. CWE identifiers from the issue type are set on each finding, and a CVE is recorded when AppScan provides one, so findings can be filtered and reported by weakness class.
• Fix guidance carried over. AppScan's fix recommendation text becomes the finding's mitigation, and its links become references.
• A rescan lifecycle. Reimporting a new report into the same Test mitigates issues that are gone, adds new ones, and reactivates any that returned.
• SLAs, assignment, and Jira. AppScan severities map onto DefectDojo's scale, so web findings follow the same SLA rules and ticketing flow as everything else.

How This Integration Works

DefectDojo imports these reports with the IBM AppScan DAST scan type. The parser checks that the file's root element is xml-report and rejects anything else.

1. Export an XML report. In AppScan Standard, generate the report as XML from a completed scan. From the command line, AppScanCMD's report command does the same:

AppScanCMD.exe report /base_scan "C:\scans\portal.scan" /report_file "C:\scans\portal-appscan.xml" /report_type xml

HCL's documentation notes that the minimum severity option does not apply to XML reports, so filter on import in DefectDojo instead.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select IBM AppScan DAST, and upload the file. For automation, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=IBM AppScan DAST" \
  -F "file=@portal-appscan.xml" \
  -F "product_name=customer-portal" \
  -F "engagement_name=Quarterly DAST" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "IBM AppScan DAST" \
  --report-path "./portal-appscan.xml" \
  --product-name "customer-portal" \
  --engagement-name "Quarterly DAST" \
  --auto-create-context

3. Reimport rescans. Send later scans of the same application to /api/v2/reimport-scan/ against the same Test so fixes are recorded as mitigations.

If your XML comes from HCL AppScan on Cloud, DefectDojo has a separate parser for it under the HCLAppScan XML scan type.

Data Granularity: What Gets Imported

Request and response pairs, variants, and per-parameter details from the report are not imported.

Use Cases

For quarterly application testing: An AppSec team scans each customer-facing application every quarter and reimports into a Test per application. Owners see what is new, what was fixed, and what has aged past its SLA.

Before a major release: A scan of the staging environment is imported into a release Engagement, and High findings are pushed to Jira so they are visible in the sprint where the fix belongs.

For compliance reporting: PCI-DSS and similar programs expect regular web application testing with evidence of remediation. DefectDojo keeps discovery date, severity, owner, and closure for every AppScan finding.

When consolidating DAST tools: Organizations running AppScan on some applications and other DAST scanners on others can compare results by CWE across all of them on one Asset list.

Operational Tips

• Check the affected URLs in AppScan when you need the full list. Occurrences of the same issue are merged, and only the first occurrence's URL is attached as the endpoint, while the advisory text is appended again for each additional occurrence.
• Use minimum_severity on import, since the AppScan XML report does not honor its own minimum severity setting. Informational issues can be numerous.
• Keep one Test per application and scan profile. Mixing authenticated and unauthenticated scans in one Test makes reimport close findings that simply were not reached.
• Use CWE filters to group related issue types when planning remediation sprints.
• Record the scan configuration and environment in the Engagement description so a later reader knows what the results covered.
• If you have moved to HCL AppScan on Cloud, switch to the HCLAppScan XML scan type rather than forcing its export through this parser.