KICS Integration with DefectDojo

KICS Integration with DefectDojo

KICS (Keeping Infrastructure as Code Secure) is an open source static analysis tool from Checkmarx for infrastructure as code. It scans Terraform, Kubernetes manifests, Helm charts, Dockerfiles, CloudFormation, Ansible, Azure Resource Manager templates, OpenAPI definitions, and other formats for security misconfigurations, using a library of queries written in Rego. Each query has a severity, a category, and a platform, and results can be written in several formats, including the JSON report DefectDojo imports.

KICS Integration with DefectDojo

We run KICS on every pull request that touches infrastructure code because it is quick and covers most of the formats our platform team writes. What it doesn't do is remember. A KICS JSON report from Tuesday has no idea which of its results we fixed on Monday or accepted last quarter. Importing KICS into DefectDojo turns each failed query on each file and line into a Finding on the right Asset, matched against earlier runs, with an owner and an SLA.

Why KICS Matters

Infrastructure as code moves security decisions into pull requests. An open security group or an unencrypted bucket is a line in a Terraform file before it is a resource in a cloud account.

• Catching misconfigurations in code is cheaper than finding them in a live environment.
• One tool covers many IaC formats, so mixed Terraform, Kubernetes, and Dockerfile repositories don't need a scanner per format.
• Each result points to a file and line, with the expected and actual values, so the fix is usually obvious.
• Raw reports from every pull request pile up. Without a platform, nobody knows which misconfigurations have been open for months.

Advantages of This Integration

What we gained by sending KICS results through DefectDojo:

• Deduplication by location. DefectDojo hashes KICS findings on file path, line, severity, description, and title, so rescanning an unchanged repository doesn't duplicate anything.
• Within-report consolidation. The parser merges repeated results for the same query, platform, category, issue type, file, expected value, and line, and counts the repeats as occurrences.
• Fix guidance in the finding. KICS's expected value becomes the mitigation, and the query URL becomes the reference, so the developer knows what correct looks like.
• Platform as component. The KICS platform (for example Terraform or Kubernetes) is stored as the component name, which makes it easy to report by IaC technology.
• Lifecycle, SLAs, and Jira. Reimporting mitigates what was fixed, severities map directly to DefectDojo's scale, and findings can be assigned or pushed to Jira.

How This Integration Works

DefectDojo imports KICS output with the KICS Scan scan type.

1. Produce a JSON report. Point KICS at the directory to scan and write JSON to an output directory:

kics scan -p ./infrastructure -o ./kics-results --report-formats json

By default KICS names the file results.json inside the output directory. Use --output-name to change it. KICS also publishes a container image (checkmarx/kics), which is a common way to run it in CI without installing the binary; mount the repository into the container and pass the same flags. The JSON report includes run totals and severity counters as well as the per-query results, but only the queries array is read by the parser.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select KICS Scan, and upload the file. For automation, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=KICS Scan" \
  -F "file=@kics-results/results.json" \
  -F "product_name=platform-infra" \
  -F "engagement_name=IaC" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "KICS Scan" \
  --report-path "./kics-results/results.json" \
  --product-name "platform-infra" \
  --engagement-name "IaC" \
  --auto-create-context

3. Reimport on each run. Send later reports to /api/v2/reimport-scan/ against the same Test so fixed misconfigurations are mitigated and the history stays in one place.

Data Granularity: What Gets Imported

The parser does not set CWE, and it ignores KICS's similarity_id, search_key, and summary counters.

Use Cases

In pull request checks: Every pull request that touches infrastructure code runs KICS, and the main branch scan reimports into a Test per repository. The platform team sees which misconfigurations are new in the last merge.

For a Kubernetes platform team: Helm charts and manifests across many services are scanned nightly, and findings are filtered by component name to separate Kubernetes issues from Terraform issues when planning work.

Before a cloud migration: A team moving workloads imports KICS results for the new Terraform modules into a migration Engagement and uses SLA reports to confirm High findings are closed before cutover.

Alongside runtime posture tools: With KICS findings in code and cloud posture findings from a CSPM scanner on the same Asset, AppSec leads can see which live misconfigurations also exist in the code that deploys them.

Operational Tips

• Watch the severity fallback. Any KICS severity outside the five standard levels becomes Medium, so exclude TRACE results in KICS if they would inflate your Medium count.
• Because line is part of the hash, editing lines above a finding can make it appear new. Reimport into the same Test so the old copy is mitigated.
• Use KICS's own exclusion options for test fixtures and example files rather than marking each result as a false positive in DefectDojo.
• Set minimum_severity on import while you work down an initial backlog of Info and Low results.
• Use one Test per repository and reimport into it, rather than a new Test per pull request, so trends stay readable.
• Filter by component name to give each platform team only the IaC findings for the technology they own.
• Risk-accept findings that are intentional, such as a deliberately public static site bucket, with an expiration date so the decision is reviewed instead of forgotten.