Mozilla Observatory Integration with DefectDojo
Mozilla HTTP Observatory is an open-source website security scanner that performs automated compliance assessments of HTTP security configurations by analyzing security headers, TLS settings, content security policies, cookie security, and other critical security best practices to identify vulnerabilities including cross-site scripting (XSS), man-in-the-middle attacks, and cross-domain information leakage. The platform provides detailed, graded security reports with scores ranging from F to A+, actionable remediation guidance linked to comprehensive documentation, and a public API that enables integration into CI/CD pipelines and security workflows, helping developers and system administrators strengthen their web application security posture against common threats.
Data Granularity: What Gets Imported
The following fields are captured from Mozilla Observatory results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Mozilla Observatory",
"engagement": "<engagement-id>",
"file": "results.json"
}