Invicti Integration with DefectDojo

Invicti Integration with DefectDojo

Invicti is a commercial dynamic application security testing (DAST) scanner from Invicti Security. The product was previously sold as Netsparker and took the Invicti name in 2021. It comes as Invicti Enterprise, available in the cloud or on premises, and Invicti Standard, a desktop scanner. Invicti crawls web applications and APIs, sends test requests to find vulnerabilities, and uses what it calls proof-based scanning to confirm many findings automatically. Scan results can be exported in several report formats, including a Vulnerabilities List in JSON, which is what DefectDojo imports.

Invicti Integration with DefectDojo

We run Invicti because its confirmed findings save our team hours of manual verification, and we send its results to DefectDojo because remediation happens across many tools, not just one. An Invicti Vulnerabilities List imported into DefectDojo becomes one Finding per issue type, with every affected URL attached as an endpoint and the HTTP request and response kept as evidence. Those Findings sit on the same Asset as our SAST and dependency results, with owners, SLAs, and Jira tickets, and later scans update them instead of starting over.

Why Invicti Matters

DAST tells you what an attacker can reach in the running application. Invicti is built to cut down the false positives that make DAST results hard to act on.

• Proof-based scanning confirms many vulnerabilities with evidence, so confirmed findings can go straight to developers.
• Findings are classified against CWE, OWASP, PCI DSS, HIPAA, and ISO 27001, which helps with compliance reporting.
• Each finding includes remediation guidance and references written for developers.
• Invicti records the request and response that triggered each finding.
• Its findings still only describe the web layer. To see an application's full risk, they need to sit next to code, dependency, and infrastructure findings.

Advantages of This Integration

What we gained by importing Invicti results into DefectDojo:

• One Finding per issue, all URLs attached. Within a report, vulnerabilities with the same name merge into one Finding, with each URL added as an endpoint and each request and response pair kept.
• Deduplication across scans. DefectDojo matches Invicti findings on title, description, and severity, so a rescan updates existing Findings instead of duplicating them.
• Triage decisions carried over. Items Invicti marks as False Positive arrive as inactive false positives, and Accepted Risk items arrive risk-accepted.
• CVSS context. The CVSS vector from Invicti's classification is stored on the Finding for prioritization and reporting.
• A shared remediation process. Reimport, SLAs per severity, assignment, notes, and Jira push work the same way for Invicti as for every other scanner.

How This Integration Works

DefectDojo imports Invicti results with the Invicti Scan scan type. (Older Netsparker exports have their own Netsparker Scan type, which uses the same parser.)

1. Export a Vulnerabilities List in JSON. In Invicti Enterprise, open the scan under Scans > Recent Scans, select Report, choose Vulnerabilities List under Lists, set the format to JSON, choose whether to include confirmed and unconfirmed findings or exclude addressed issues, and export the file.

2. Import the file. In the UI, open the Engagement, choose Import Scan Results, select Invicti Scan, and upload the JSON. To automate it (Community Edition and DefectDojo Pro):

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Invicti Scan" \
  -F "file=@invicti-vulnerabilities.json" \
  -F "product_name=online-banking" \
  -F "engagement_name=Invicti Weekly" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Invicti Scan" \
  --report-path "./invicti-vulnerabilities.json" \
  --product-name "online-banking" \
  --engagement-name "Invicti Weekly" \
  --auto-create-context

3. Optionally, push from Invicti Enterprise. Invicti Enterprise has a DefectDojo integration under Integrations > New Integration > Issue Tracking Systems. You give it your DefectDojo URL, an API key, and the target Asset and Engagement IDs, and it sends findings to DefectDojo after scans. This is configured on the Invicti side and uses the DefectDojo API.

4. Reimport recurring scans. For a site you scan on a schedule, reimport each export into the same Test with /api/v2/reimport-scan/ so findings no longer reported are mitigated.

Data Granularity: What Gets Imported

Invicti's Certainty and Confirmed values are not mapped to Finding fields, so confirmation status needs to be handled at export time or during triage.

Use Cases

For weekly production scans: A security team schedules Invicti scans of customer-facing applications and reimports each Vulnerabilities List into a standing Test. New issues are assigned with SLA deadlines, and fixed ones close on the next scan.

For pre-release testing: A release Engagement collects Invicti results from staging along with SAST and SCA imports, giving the release manager one list of open issues to sign off on.

With confirmed and unconfirmed findings: A team exports confirmed findings and imports them with verified=true, then imports unconfirmed findings separately with verified=false so they get a manual review before work is assigned.

For compliance reporting: Invicti findings in DefectDojo carry their discovery date, owner, and closure date, which gives PCI DSS or SOC 2 evidence of how quickly web vulnerabilities were remediated.

Operational Tips

• Decide how to handle unconfirmed findings before the first import. The parser doesn't read Invicti's confirmation fields, so either export confirmed and unconfirmed separately or review them in DefectDojo.
• Expect the static flag on Invicti Findings. Filter by test type rather than the static/dynamic flag when building DAST-only views.
• Because findings merge by name within a file and deduplicate on title, description, and severity, one Asset gets one Finding per issue type. Scan different applications into different Assets.
• Exclude addressed issues at export only if you are sure you don't need them. Importing everything and letting Invicti's False Positive and Accepted Risk states carry over keeps the record complete.
• Invicti BestPractice and Information items arrive as Info. Set your Info SLA with that in mind, or filter them out with minimum_severity.
• Use the native Invicti Enterprise push or a scheduled API import, not both, for the same Test, so findings don't arrive twice.