Kiuwan Integration with DefectDojo

Kiuwan Integration with DefectDojo

Kiuwan is a commercial application security platform that offers static application security testing (Kiuwan Code Security) and software composition analysis (Kiuwan Insights). Its SAST engine analyzes source code in many languages against rules mapped to CWE, OWASP, CERT, and PCI-DSS, and reports each defect with its file, line, priority, and the data flow source where one exists. Insights inventories open source components and reports known vulnerabilities in them. DefectDojo has a parser for each: the SAST results as a CSV export, and Insights security results as JSON from the Kiuwan REST API.

Kiuwan Integration with DefectDojo

We use Kiuwan for code analysis on applications where the rule mapping to compliance standards matters to our auditors. Its dashboards are fine for one application. Across dozens of applications and several other scanners, we needed one place to assign, track, and report. Importing Kiuwan results into DefectDojo puts each vulnerability on the Asset that owns the code, with its CWE, file, line, source-to-sink context, and an SLA based on Kiuwan's priority.

Why Kiuwan Matters

Code-level flaws and vulnerable dependencies are the two biggest sources of application findings, and Kiuwan covers both.

• Its SAST results include the source file and line where tainted data enters as well as the sink, which helps developers confirm an injection path.
• Every rule carries normative references (CWE, OWASP Top 10, CERT, PCI-DSS), which ties findings to the standards an audit will ask about.
• Insights adds component-level vulnerability data, including CVE, CVSS v3 score, and EPSS, for the libraries an application ships.
• Without a central platform, Kiuwan findings sit apart from DAST, container, and pentest findings for the same application.

Advantages of This Integration

What we gained by sending Kiuwan results through DefectDojo:

• Priority mapped to severity. Kiuwan's five priority levels map onto DefectDojo's scale (Very High becomes Critical, Normal becomes Medium, Very Low becomes Info), so SLAs apply cleanly.
• Data flow context kept. The SAST description includes the source file, source line, and code at both ends, plus the normative references and CWE scope.
• Muted findings stay muted. The Insights parser skips anything muted in Kiuwan, so false positive decisions made there carry over.
• Exploit likelihood in view. Insights findings carry EPSS score and percentile, and CVSS v3 base score, which helps rank dependency fixes.
• Lifecycle and ticketing. Reimporting a new export mitigates what was fixed, and findings can be assigned or pushed to Jira.

How This Integration Works

There are two scan types, one per Kiuwan product.

Kiuwan Scan (SAST, CSV). Export the analysis results as CSV from the Kiuwan UI, or call the Kiuwan REST API vulnerabilities/export endpoint with type=csv. Then import with the Kiuwan Scan scan type. In the UI, open the Engagement, choose Import Scan Results, select Kiuwan Scan, and upload the CSV. To automate it in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Kiuwan Scan" \
  -F "file=@kiuwan-vulnerabilities.csv" \
  -F "product_name=claims-portal" \
  -F "engagement_name=SAST" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Kiuwan Scan" \
  --report-path "./kiuwan-vulnerabilities.csv" \
  --product-name "claims-portal" \
  --engagement-name "SAST" \
  --auto-create-context

Kiuwan SCA Scan (Insights, JSON). Call the Kiuwan REST API insights/analysis/security endpoint for an application and analysis code, save the data array from the response as a JSON file, and import it with the Kiuwan SCA Scan scan type using the same UI, API, or Universal Importer steps.

For both, reimport later exports into the same Test through /api/v2/reimport-scan/ so fixes are recorded as mitigations.

Data Granularity: What Gets Imported

Kiuwan Scan (SAST CSV):

Within one CSV, rows with the same severity, title, description, and CWE are imported once.

Kiuwan SCA Scan (Insights JSON):

Muted entries and entries with no components are skipped.

Use Cases

For compliance-driven code review: A team subject to PCI-DSS imports Kiuwan SAST results per application. Normative references in each description show which requirement a finding relates to, and SLA reports provide remediation evidence.

For dependency risk: Insights findings sorted by EPSS percentile tell the team which vulnerable libraries to upgrade first, rather than working strictly by CVSS.

In a release process: Each release candidate is analyzed in Kiuwan, exported, and reimported into a Test per application, and new Critical findings are pushed to Jira before sign-off.

Across a mixed toolset: Kiuwan findings sit beside DAST and container results for the same Asset, giving security leads one report per application.

Operational Tips

• Add remediation guidance yourself or link to Kiuwan. The SAST parser sets mitigation and references to "Not provided!", so developers need the rule documentation in Kiuwan.
• Unrecognized priority values become Info. If your export uses custom priority labels, check severities after the first import.
• Mute false positives in Kiuwan before exporting Insights data. The SCA parser honors muting, so the decision only has to be made once.
• Keep SAST and SCA imports in separate Tests with their own scan types so reimport compares like with like.
• When tuning deduplication, note that DefectDojo's settings define hashcode fields only for Kiuwan SCA Scan. Kiuwan Scan falls back to the default legacy algorithm, which also weighs file path and line.
• Tag imports with the Kiuwan analysis code or release so findings can be traced back to a specific analysis.