IriusRisk Integration with DefectDojo

IriusRisk Integration with DefectDojo

IriusRisk is a threat modeling platform from the company of the same name. Teams describe a system's architecture as components and data flows, and IriusRisk's rules engine generates the threats that apply to that design, along with countermeasures and their implementation status. Each threat carries inherent, current, and projected risk ratings, and projects can be exported as CSV. DefectDojo imports those CSV exports, and DefectDojo Pro can pull threat modeling data directly through a connector.

IriusRisk Integration with DefectDojo

We model new services in IriusRisk before they are built, and we bring those threat models into DefectDojo so design risk doesn't live in a separate world from implementation risk. Each IriusRisk threat becomes a Finding on the Asset for that service, rated by its current risk and carrying the countermeasure status in its description. Engineers see the threats that are still unmitigated next to the SAST and DAST findings for the same code, and security leads can report on design-level risk with the same SLAs and dashboards as everything else.

Why IriusRisk Matters

Some of the most expensive security problems are design decisions, and scanners can't see a missing control that was never built.

• Threat modeling identifies risks before code exists, when they are cheapest to fix.
• IriusRisk generates threats from rules, so models stay consistent across teams instead of depending on who ran the workshop.
• Countermeasure tracking shows how much of each threat has been mitigated, planned, or left open.
• A threat model that stays in its own tool tends to be forgotten after the design review. Tracking unmitigated threats as Findings keeps them in front of the team.

Advantages of This Integration

What we gained by routing IriusRisk threats through DefectDojo:

• Design threats next to scanner results. Threats sit on the same Asset as code, dependency, and runtime findings, so one view covers the service.
• Mitigated threats stay out of the way. Threats whose current risk is "Very low" are imported as inactive, so fully mitigated items don't inflate open counts.
• Progress through reimport. As the model changes, reimporting an updated export into the same Test adds new threats and mitigates threats that no longer appear.
• Stable deduplication. DefectDojo hashes on threat title and component name, which don't change when risk levels or countermeasure progress change.
• Ownership and SLAs. Unmitigated High and Critical threats can be assigned, given SLAs, and pushed to Jira so the missing control gets built.

How This Integration Works

Option 1: CSV import. DefectDojo imports IriusRisk exports with the IriusRisk Threats Scan scan type.

1. In IriusRisk, open the project that holds the threat model and export its threats as CSV.
2. In DefectDojo, open the Engagement, choose Import Scan Results, select IriusRisk Threats Scan, and upload the file.

For automation, use the API, which works the same way in Community Edition and DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=IriusRisk Threats Scan" \
  -F "file=@iriusrisk-threats.csv" \
  -F "product_name=payments-gateway" \
  -F "engagement_name=Threat Model" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "IriusRisk Threats Scan" \
  --report-path "./iriusrisk-threats.csv" \
  --product-name "payments-gateway" \
  --engagement-name "Threat Model" \
  --auto-create-context

Option 2: IriusRisk connector (DefectDojo Pro). The connector uses an API token to pull threat modeling data from your IriusRisk instance.

1. In IriusRisk, open your User Profile, select API Token, and generate a token. A dedicated service account keeps automated activity separate from people.
2. In DefectDojo Pro, add the IriusRisk connector under Connect > Upstream. Enter your instance URL in Location URL (typically https://{your-subdomain}.iriusrisk.com for cloud, or your on-premise base URL) and the token in Secret.
3. Optionally set a Minimum Severity so only threats at or above that level are imported.

After Discover, map the resulting Records to Assets. Each mapped Record syncs daily as a reimport, and findings are stored under the Asset's Global Connectors Engagement.

Data Granularity: What Gets Imported

The table describes the CSV import. All 14 columns of the export are used.

Use Cases

Secure design reviews: After a design review, the security architect imports the IriusRisk model into an Engagement for the new service. Every unmitigated High threat gets an owner and a Jira ticket before development starts.

Tracking countermeasure progress: The team reimports the export at the end of each sprint. Threats removed from the model are mitigated, new ones open, and the Test history shows how the model changed over time.

Connecting design to testing: With threats and DAST findings on the same Asset, AppSec leads can check whether a threat such as broken access control between components also shows up in testing, and adjust test scope.

Continuous modeling with DefectDojo Pro: Organizations that keep many IriusRisk projects current use the connector so threat data arrives on a schedule without anyone exporting CSVs.

Operational Tips

• Severity follows Current Risk, not Inherent Risk. A threat with a high inherent rating but implemented controls can arrive as Low or Info, which is usually what you want for SLAs.
• IriusRisk exports can contain several rows with the same component and threat but different Risk Response values. They share a dedupe hash, so review how they were handled after your first import.
• Use one Test per IriusRisk project and reimport into it, so mitigated threats close instead of piling up as separate Tests.
• Tag threat model findings (for example tags=threat-model) so dashboards can separate design threats from scanner output.
• MITRE references that aren't CWEs, such as ATT&CK technique IDs, land in References, so search there when mapping threats to adversary techniques.
• Set a minimum severity on the connector or on API imports if Low and Info threats would bury the actionable ones.