IntSights Integration with DefectDojo

IntSights Integration with DefectDojo

IntSights Threat Command is a commercial external threat intelligence platform that monitors the open and dark web for threats against the assets an organization registers with it, such as domain names, IP addresses, and brand names. Rapid7 acquired IntSights in 2021, and the platform has since been offered as Rapid7 Threat Command. It raises alerts for issues like exposed credentials, phishing domains, vulnerable technology in use, and leaked data, and alerts can be exported as CSV from the GUI or retrieved as JSON through its API.

IntSights Integration with DefectDojo

Threat intelligence alerts are only useful if someone acts on them, and our IntSights alerts used to sit in a console the AppSec team rarely opened. Importing them into DefectDojo turned each alert into a Finding on the Asset for the domain or brand it concerns, with the severity IntSights assigned, a link back to the original alert, and an owner. An alert about a weak HTTP header on a public site now gets the same follow-through as a scanner finding on that site.

Why IntSights Matters

Some of the most actionable security signals come from outside the network: a credential dump that includes corporate accounts, a lookalike domain registered last week, or a forum post naming a vulnerable service you run.

• It watches sources that internal scanners never see, including paste sites, forums, and marketplaces.
• Alerts are tied to the specific assets you register, which narrows a huge volume of intelligence to what concerns you.
• Many alerts describe exposures that internal teams can fix directly, such as vulnerabilities in internet-facing technology or misconfigured web servers.
• On their own, alerts live in a separate workflow from vulnerability remediation, which makes it hard to hold anyone to an SLA.

Advantages of This Integration

What we gained by sending IntSights alerts into DefectDojo:

• Status carried over. Alerts closed in IntSights import as inactive findings, and open alerts import as active, so the DefectDojo view matches the source.
• Verified on arrival. The parser marks every IntSights finding as verified, so alerts skip the verification step and go straight into triage queues that filter on verified findings.
• A link back to the source. Each finding's references hold the IntSights alert link, so analysts can jump to the full context and images in the console.
• Ownership and SLAs. Findings can be assigned, given notes, risk-accepted, or pushed to Jira, and severity-based SLAs apply.
• External and internal risk together. Threat intelligence alerts sit next to DAST and infrastructure findings for the same Asset, which helps prioritization.

How This Integration Works

DefectDojo imports IntSights alerts with the IntSights Report scan type. The parser selects a format by file extension: .json or .csv. Any other extension is rejected.

1. Produce the file.

• JSON (for automation): The IntSights get-complete-alert API returns one alert at a time. Fetch each alert you want, collect them into a list, and save that list as the value of a top-level Alerts key in a JSON file.
• CSV (manual): Use Export CSV in the IntSights Threat Command GUI to create an alerts CSV file. The parser requires the exact set of 19 column headers from that export, and it imports nothing if any header is missing or unexpected.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select IntSights Report, and upload the file. For automation, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=IntSights Report" \
  -F "file=@intsights-alerts.json" \
  -F "product_name=external-exposure" \
  -F "engagement_name=Threat Intel" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "IntSights Report" \
  --report-path "./intsights-alerts.json" \
  --product-name "external-exposure" \
  --engagement-name "Threat Intel" \
  --auto-create-context

3. Reimport on a schedule. Reimport fresh exports into the same Test so alerts that dropped out of the export are mitigated and updated statuses are reflected.

Data Granularity: What Gets Imported

Within one file, alerts are keyed by alert ID, so repeated IDs produce one finding. CSV rows missing an alert ID, title, severity, or status are skipped. Assignees, remediation, closed reason, and rating columns are not imported, and IntSights tags are not converted to DefectDojo tags.

Use Cases

For external attack surface alerts: Alerts about vulnerable technology on public hosts are imported into the Asset that owns those hosts, assigned to the infrastructure team, and tracked against the High or Medium SLA.

For leaked credential response: When IntSights reports exposed corporate credentials, the finding gives the identity team a tracked task with the source and affected domain in the description, and its closure is recorded.

For brand and phishing monitoring: Lookalike domain alerts land in a dedicated Asset where the security team records takedown progress in notes, giving leadership one place to see open external threats.

For executive reporting: Combining threat intelligence alerts with internal findings lets security leads show which external threats map to known internal weaknesses.

Operational Tips

• Keep the IntSights alert ID in mind when closing findings. It is stored as the unique ID from tool, but the default dedupe algorithm for this scan type does not use it, so reimport into the same Test rather than importing each export as a new one.
• Check severity values before relying on SLAs. The parser passes IntSights severity through unchanged, so confirm your export uses values DefectDojo recognizes.
• If a CSV import returns zero findings, compare its header row to the documented 19 columns. A renamed or extra column causes the whole file to be skipped.
• Use a separate Asset for brand and phishing alerts that have no internal system owner, so they don't distort application metrics.
• Tag imports with the alert category you exported (for example tags=threat-intel,credentials), since IntSights tags are not carried over.
• Because closed alerts arrive inactive, close the alert in IntSights when remediation is done and let the next reimport record it.