Nexpose Integration with DefectDojo
Nexpose is an on-premises vulnerability management solution by Rapid7 that provides comprehensive asset discovery, vulnerability scanning, risk assessment, and policy compliance monitoring across IT infrastructure including servers, workloads, cloud environments, and network devices to identify security exposures before they can be exploited. The platform delivers adaptive security with real-time vulnerability detection, integration with Metasploit for exploit validation, actionable 1-1000 risk scoring that prioritizes vulnerabilities based on exploitability and business impact, and automated remediation reporting aligned with CIS, NIST, PCI-DSS, and other compliance standards to enable security teams to effectively reduce risk across dynamic environments.
Data Granularity: What Gets Imported
The following fields are captured from Nexpose results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Nexpose",
"engagement": "<engagement-id>",
"file": "results.json"
}