NeuVector Integration with DefectDojo

NeuVector Integration with DefectDojo

NeuVector is a container and Kubernetes security platform, acquired by SUSE in 2021 and released as open source afterward. It provides vulnerability scanning for images, running containers, and nodes, CIS benchmark compliance checks for Docker and Kubernetes hosts, and runtime protection such as network segmentation and process monitoring. NeuVector exposes its results through a REST API on the controller, and DefectDojo imports two kinds of JSON from that API: vulnerability scan results and compliance results. DefectDojo Pro also offers a NeuVector connector that reads image vulnerability scans from the controller directly.

NeuVector Integration with DefectDojo

NeuVector already watches our clusters, but its console is not where remediation work gets assigned or measured. We pull NeuVector's JSON from its REST API and import it into DefectDojo, where container CVEs become Findings with package and version details, and CIS benchmark failures become Findings with the check number and remediation text. Both land on the Asset that owns the workload or cluster, carry SLA timers, and close on reimport when the fix is in. On DefectDojo Pro, the NeuVector connector handles the image vulnerability side without any scripting.

Why NeuVector Matters

Container platforms carry two different kinds of risk, and NeuVector reports on both.

• Vulnerability scans identify CVEs in operating system and application packages inside images and running workloads, with fixed versions where they exist.
• Compliance scans check hosts and containers against Docker and Kubernetes CIS benchmarks and tag results with frameworks such as GDPR, HIPAA, and NIST.
• Because NeuVector runs inside the cluster, it sees what is actually deployed, not just what passed through a registry.
• The console shows current state. It does not track how long a CVE has been open, who owns it, or whether anyone accepted the risk.

Advantages of This Integration

What we gained by sending NeuVector results through DefectDojo:

• Two scan types, one Asset. CVEs and compliance failures for the same cluster or workload sit together, alongside image scans and IaC findings from other tools.
• Deduplication tuned to each data type. Vulnerability findings are hashed on title, severity, component name, and component version. Compliance findings are hashed on title, the tool's check ID, and description.
• Lifecycle on reimport. Reimporting a new export into the same Test mitigates CVEs and failed checks that are gone, adds new ones, and reactivates regressions.
• CVE search across workloads. Each vulnerability finding stores its CVE as a vulnerability ID, so one search shows every workload carrying it.
• Image scans without scripts on DefectDojo Pro. The NeuVector connector logs in to the controller, discovers every image NeuVector has scanned, creates a Record for each, and imports its scan report on a schedule.
• Ownership and ticketing. Findings can be assigned to platform or application teams, risk-accepted with an expiration date, or pushed to Jira.

How This Integration Works

DefectDojo provides two scan types for NeuVector, both for JSON returned by the NeuVector REST API:

• NeuVector (REST) for vulnerability scan results from the /v1/scan/{entity}/{id} endpoints, for example a workload or image scan.
• NeuVector (compliance) for compliance results, either the items list returned by endpoints such as /v1/host/{id}/compliance or the checks section of a scan report.

1. Fetch the JSON. Authenticate to the NeuVector controller's REST API (port 10443 by default) to get a session token, then send it in the X-Auth-Token header when you request the data. For a workload's vulnerabilities, call /v1/scan/workload/{id} and save the response as, for example, neuvector-workload.json. For a host's CIS results, call /v1/host/{id}/compliance and save it as neuvector-host-compliance.json. Both parsers reject files that do not end in .json.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select the matching NeuVector scan type, and upload the file. For automation, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=NeuVector (REST)" \
  -F "file=@neuvector-workload.json" \
  -F "product_name=payments-cluster" \
  -F "engagement_name=Runtime Scans" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer, here for compliance results:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "NeuVector (compliance)" \
  --report-path "./neuvector-host-compliance.json" \
  --product-name "payments-cluster" \
  --engagement-name "CIS Benchmarks" \
  --auto-create-context

3. Reimport on a schedule. Keep one Test per workload or host and scan type, and send later exports to /api/v2/reimport-scan/ so fixes are recorded as mitigations.

Option: NeuVector connector (DefectDojo Pro). For image vulnerability scans, configure the NeuVector connector in the DefectDojo Pro UI. Enter your controller URL in the Location field, including the REST API port (for example https://neuvector.example.com:10443), then the Username and Password of a controller account that can read scan results. Set Skip TLS Verification to true if the controller uses a self-signed certificate, and optionally set a Minimum Severity. Each scanned image becomes a Record that you map to an Asset. The connector covers image vulnerabilities only, so keep using the NeuVector (compliance) file import for CIS results.

Data Granularity: What Gets Imported

NeuVector (REST) creates one finding per CVE, package, and version:

NeuVector (compliance) creates one finding per check:

The DefectDojo Pro connector maps each CVE in an image's scan report to a finding. Severity comes from NeuVector's own rating, and the affected package and version, CVSS v3 score and vector, fix version (as mitigation), and reference link are carried over. Connector findings are deduplicated on image, CVE, package, version, and severity.

Use Cases

For runtime CVE tracking: A scheduled job pulls workload scan results for each production deployment and reimports them. When a base image update rolls out, the next reimport mitigates the CVEs it fixed and leaves the rest open with their original discovery dates.

For CIS benchmark programs: Platform teams import host compliance results for every node pool. Failed checks become findings with remediation text, and audit teams can filter by benchmark tags such as HIPAA or NIST.

Across clusters: An organization with separate clusters per environment imports each into its own Asset, giving security leads one comparison of open CVEs and benchmark failures by cluster.

For exceptions: Some benchmark checks do not fit a managed Kubernetes service. Risk-accepting them in DefectDojo with a justification and expiry keeps that decision documented and reviewable.

Operational Tips

• Passing checks import too. PASS, NOTE, and ERROR levels become Info findings, so set minimum_severity=Low on compliance imports unless you want a record of every pass.
• Watch the compliance description. It is part of the dedupe hash and includes evidence and messages, so if those change between runs, the same check can appear as a new finding.
• Keep vulnerability and compliance imports in separate Tests. They use different scan types and different dedupe rules.
• Name files with a .json extension in your scripts. Anything else fails with an unknown file format error.
• For the DefectDojo Pro connector, create a dedicated controller account with read access to scan results rather than reusing an admin login. The connector never logs the password or session token.
• Treat NeuVector session tokens like any other credential: store them in your CI secret store and request a fresh one for each run.
• Tag imports with the cluster and namespace (for example tags=prod,payments) to filter findings by owner.