Immuniweb Integration with DefectDojo

Immuniweb Integration with DefectDojo

ImmuniWeb is a commercial application security testing and attack surface management platform from ImmuniWeb SA, based in Geneva, Switzerland. Its services combine automated scanning with human verification to test web applications and APIs, and to discover and monitor an organization's external assets such as domains, web applications, mobile apps, cloud services, network hosts, exposed code repositories, and data leak incidents. DefectDojo's parser reads two ImmuniWeb export formats: an XML list of vulnerabilities and a JSON export organized by asset sections. DefectDojo Pro also offers an ImmuniWeb connector that pulls web application findings through ImmuniWeb's API.

Immuniweb Integration with DefectDojo

We use ImmuniWeb for testing that combines a scanner with human review, and the results it returns are usually worth acting on. Our problem was that they lived in ImmuniWeb's portal while everything else lived in DefectDojo. Importing ImmuniWeb exports puts tested web vulnerabilities on the same Asset as our code and dependency findings, attaches the affected URL and proof of concept, and gives each one an owner and an SLA. On DefectDojo Pro, the ImmuniWeb connector can do the pulling for us on a schedule.

Why Immuniweb Matters

Web applications and the external footprint around them change faster than most inventories. Testing the application and watching the perimeter are both needed.

• Its vulnerability results include a CWE, a risk rating, the affected URL, and a proof of concept request, which shortens the path from report to reproduction.
• Human verification in the testing process means fewer false positives reach the team.
• Its asset discovery output surfaces things teams forget they own: stale subdomains, unreachable web apps, exposed repositories, and credential leaks tied to the company's domains.
• Without a central platform, those results stay in a separate portal and are hard to report on alongside the rest of an application's risk.

Advantages of This Integration

What we gained by importing ImmuniWeb results into DefectDojo:

• Proof of concept kept with the finding. XML imports carry ImmuniWeb's PoC into Steps to Reproduce, so the developer sees exactly what was tested.
• Severity alignment. ImmuniWeb risk levels map onto DefectDojo's scale, and Warning becomes Info, so SLAs apply consistently.
• Within-report consolidation. In XML imports, entries with the same name, description, and severity are merged into one finding.
• Remediations as work items. JSON imports create one finding per remediation ImmuniWeb recommends for an asset, with the asset's link or IP as the endpoint.
• Scheduled sync with DefectDojo Pro. The ImmuniWeb connector creates a Record for each tested asset (website) on the account and imports that asset's detected vulnerabilities, so there is no export step.
• Lifecycle and ticketing. Reimporting into the same Test mitigates what disappeared and reactivates what returned, and findings can be assigned or pushed to Jira.

How This Integration Works

DefectDojo imports both formats with the Immuniweb Scan scan type. The parser picks the format by file extension: files ending in .xml are read as XML, and anything else is read as JSON. Keep the original extension when you save the export.

1. Export results from ImmuniWeb. Download the vulnerability results as XML, or the asset export as JSON, from the ImmuniWeb platform.

2. Import the file. In the UI, open the Engagement, choose Import Scan Results, select Immuniweb Scan, and upload the file. For automation, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Immuniweb Scan" \
  -F "file=@immuniweb-results.xml" \
  -F "product_name=public-web" \
  -F "engagement_name=ImmuniWeb Testing" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Immuniweb Scan" \
  --report-path "./immuniweb-results.xml" \
  --product-name "public-web" \
  --engagement-name "ImmuniWeb Testing" \
  --auto-create-context

3. Reimport updated exports. After retesting or a new discovery cycle, reimport into the same Test so closed items are mitigated.

Option: ImmuniWeb connector (DefectDojo Pro). Configure the ImmuniWeb connector in the DefectDojo Pro UI. Enter your ImmuniWeb API URL in the Location field and an ImmuniWeb premium API key in the API Key field, and optionally set a Minimum Severity to limit which findings are imported. The key is required even though ImmuniWeb treats it as optional: without a premium key, ImmuniWeb truncates the vulnerability list it returns, and DefectDojo would rather not start than import an incomplete set. Each tested asset becomes a Record that you map to an Asset.

Data Granularity: What Gets Imported

XML vulnerability export:

JSON asset export:

JSON items without remediations are skipped, and the XML CVSSv3 value is not imported.

The tables above describe file imports. The DefectDojo Pro connector works per tested asset (website): each becomes a Record carrying that asset's detected web application vulnerabilities.

Use Cases

After a web application test: The AppSec team imports the XML results into an Engagement for the test, assigns each finding to the application owner, and pushes High and Critical issues to Jira with the PoC attached.

For attack surface hygiene: A security team imports the JSON export monthly into a dedicated Asset for external exposure. Recommendations such as missing TLS on a web app or an exposed repository become assigned findings rather than items in a portal nobody checks.

For leak response: Data leak incidents in the JSON export arrive with passwords redacted and the remediation text attached, giving the identity team a tracked task to force resets for affected accounts.

For audit evidence: Tested vulnerabilities keep their discovery date, severity, owner, and closure in DefectDojo, which answers the question of whether third-party test findings were remediated.

Operational Tips

• Set severity on JSON findings during triage. Every attack surface item arrives as Info, so SLAs will not apply meaningfully until someone rates them.
• Copy ImmuniWeb's remediation advice from the platform when needed. The XML parser leaves Mitigation as "N/A".
• Keep XML and JSON imports in separate Tests. They describe different things, and reimporting one format into a Test built from the other would mitigate everything.
• Check the affected URLs in ImmuniWeb for merged XML findings. Only the first occurrence's URL becomes the endpoint.
• Restrict access to Assets that hold leak data. Passwords in examples are redacted, but logins and the source item JSON remain in the description.
• For the DefectDojo Pro connector, get a premium ImmuniWeb API key before setup. Without one, ImmuniWeb returns a truncated vulnerability list, which would make the connector under-report.
• Use tags from ImmuniWeb, which the JSON import carries over, to filter findings by asset group.