Netsparker Integration with DefectDojo
Netsparker (now Invicti) is a proof-based dynamic application security testing (DAST) platform that automatically scans web applications, APIs, and services to identify security vulnerabilities including SQL injection, cross-site scripting, authentication flaws, and other OWASP Top 10 threats with 99.98% accuracy by exploiting detected issues to confirm they are real and not false positives. The platform combines automated scanning with comprehensive vulnerability validation and detailed remediation guidance, integrating seamlessly into CI/CD pipelines and developer workflows to enable continuous security testing throughout the software development lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from Netsparker results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Netsparker",
"engagement": "<engagement-id>",
"file": "results.json"
}