JFrog Integration with DefectDojo

JFrog Xray Integration with DefectDojo

JFrog Xray is the software composition analysis product from JFrog, built to work with the Artifactory artifact repository. It scans the packages, container images, and build artifacts stored in Artifactory, recursively inspects their dependencies, and matches them against JFrog's vulnerability database. Results are available from Xray reports in the JFrog Platform UI, from the JFrog CLI's on demand binary scan, and from the Xray REST API, all of which can produce JSON. DefectDojo has parsers for each of those outputs and, in DefectDojo Pro, a connector that pulls Xray results per repository.

JFrog Xray Integration with DefectDojo

Artifactory is where our builds land, so JFrog Xray sees every artifact we ship, including the ones no developer looked at closely. What it doesn't give us is a cross-tool view of risk per application. Feeding Xray results into DefectDojo turns each vulnerable component into a Finding on the owning Asset, deduplicated across rescans, with SLAs and fixed versions attached. Our SAST and DAST results sit on the same Assets, so a release decision doesn't need three different consoles.

Why JFrog Xray Matters

Xray sits on the artifacts that actually get deployed, which is a different vantage point from scanning source manifests.

• It analyzes binaries and images as stored in Artifactory, including transitive dependencies packed inside them.
• It covers many package types (Maven, npm, PyPI, Go, NuGet, Docker, RPM, Debian, Alpine, and more) from one place.
• Findings include fixed versions, so engineers know what to upgrade to.
• The JFrog CLI can scan local files and images before they are ever uploaded, which moves the same checks earlier in the pipeline.
• Xray tells you what is vulnerable in a repository today. Ownership, SLAs, and remediation history across tools are outside what it tracks.

Advantages of This Integration

What we gained by sending JFrog Xray results through DefectDojo:

• Deduplication suited to each export. Unified reports are hashed on vulnerability IDs, file path, and component name and version. On demand scans use title plus component name and version. Summary Artifact imports match on a stable unique ID first.
• Stable reimports. The Summary Artifact parser builds its ID from the artifact digest, the impacted component, and the Xray issue ID, so JFrog rewording a CVE description doesn't close and recreate findings.
• Fix availability. Unified, on demand, and Xray 2.x imports record fixed versions in Mitigation and set DefectDojo's fix available flag, which makes it easy to filter for findings you can patch today.
• SLAs and ownership. Xray severities map to DefectDojo's scale, so component vulnerabilities fall under the same SLA rules and Jira workflow as everything else.
• Automated sync in DefectDojo Pro. The JFrog Xray connector discovers repositories and imports findings on a schedule, with no export step.

How This Integration Works

Pick the scan type that matches where your JSON came from. The names must match exactly.

• JFrog Xray Unified Scan: the JSON export of an Xray vulnerabilities report from Security & Compliance, Reports (Xray 3.x and later).
• JFrog Xray On Demand Binary Scan: JSON output of the JFrog CLI on demand binary scan (Xray 3.x).
• JFrog Xray API Summary Artifact Scan: the JSON response of the Xray Summary Artifact REST API.
• JFrog Xray Scan: the older Security Export JSON from Xray 2.x, for teams still on that version.

1. Produce the JSON. For an on demand scan with the JFrog CLI:

jf scan ./build/libs/ --format=json > xray-scan.json

For a Unified report, generate a vulnerabilities report in the JFrog Platform UI and export it as JSON. For Summary Artifact, save the API response body to a file.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, pick the matching scan type, and upload the file. To automate (Community Edition and DefectDojo Pro):

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=JFrog Xray On Demand Binary Scan" \
  -F "file=@xray-scan.json" \
  -F "product_name=orders-service" \
  -F "engagement_name=Build Scans" \
  -F "auto_create_context=true"

DefectDojo Pro users can use Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "JFrog Xray Unified Scan" \
  --report-path "./xray-unified.json" \
  --product-name "orders-service" \
  --engagement-name "Artifactory Reports" \
  --auto-create-context

3. Or connect Xray (DefectDojo Pro). The JFrog Xray connector uses the Xray REST API. Enter your instance base URL (for example https://your-instance.jfrog.io) as the Location and a Reference Token with All Services scope and Manage Reports plus Manage Resources as the Secret. DefectDojo discovers repositories, maps each to a Record, and generates a complete Xray report per repository on every Sync, so finding status tracks the repository's current state. An optional Repository Filter (comma-separated keys with * wildcards) limits discovery. With Artifact-Level Records turned on (the default for new installations), each first-level artifact, such as each Docker image, becomes its own Record, scoped to its latest build.

Data Granularity: What Gets Imported

Use Cases

Before upload: A CI job runs jf scan on the build output and imports the result into the service's Asset. New High findings fail the build, while known, risk-accepted ones don't.

For what is already in Artifactory: A platform team on DefectDojo Pro connects Xray with Artifact-Level Records turned on. Each Docker image gets its own Asset scoped to its latest build, and the Asset Hierarchy groups images under their repository.

For release sign-off: Security exports a Unified report for a release repository and imports it into the release Engagement. Filtering on fix available shows the upgrades worth doing before shipping.

During incident response: When a new CVE breaks, a search by vulnerability ID across Assets shows every artifact Xray flagged, together with its owner and SLA clock.

Operational Tips

• Don't mix scan types in one Test. Each parser builds titles and hash fields differently, so the same CVE looks like different findings across them.
• Prefer the connector or Summary Artifact for large, frequent syncs. Their identity doesn't depend on description text that JFrog updates.
• Unified reports tag findings by package type, which helps route Docker, npm, and Maven findings to different owners.
• If you switch an existing Pro connector to Artifact-Level Records, turn on Auto Map at the same time so findings move to the new artifact Assets without a gap.
• Use minimum_severity to drop Info results, which are where Xray's Unknown severity ends up.
• Leave the Repository Filter blank only if you really want every repository. A narrow filter cuts Sync time and load on your JFrog instance.