Nmap Integration with DefectDojo

Nmap Integration with DefectDojo

Nmap ("Network Mapper") is an open source network discovery and security auditing tool created by Gordon Lyon and maintained by the Nmap Project. It finds live hosts, enumerates open TCP and UDP ports, fingerprints the services and operating systems behind them, and runs Nmap Scripting Engine (NSE) scripts for deeper checks. Nmap writes several output formats, and its XML output (-oX) is the one DefectDojo imports.

Nmap Integration with DefectDojo

We import Nmap into DefectDojo because an open port list is only useful if someone notices when it changes. Run by itself, Nmap tells us what was listening on a subnet at 2 a.m. Imported into DefectDojo, every open port becomes a Finding on the Asset that owns those hosts, with endpoints attached, and the next scan of the same range shows what was closed and what newly appeared. When we add the vulners NSE script, the CVEs matched against detected service versions land in the same place with real severities.

Why Nmap Matters

Most breaches still start with something reachable that nobody meant to expose: a forgotten admin interface, a database bound to all interfaces, a test service left running after a migration.

• Nmap is the reference tool for answering "what is actually listening," and its output is trusted by network and security teams alike.
• Service and version detection (-sV) turns a port number into a product and version, which is what you need to judge whether it matters.
• NSE scripts such as vulners extend a port scan into a lightweight vulnerability check without a separate scanner.
• Exposure drifts constantly. Without history, an open port that appeared last Tuesday looks exactly like one that has been there for three years.

Advantages of This Integration

What we gained by running Nmap results through DefectDojo:

• Exposure tracked as Findings. Each open port becomes an Info Finding with the affected hosts as endpoints, so exposure can be reviewed, assigned, or risk-accepted like any other issue.
• Change detection through reimport. Reimporting a new scan of the same range into the same Test mitigates ports that closed and adds ports that opened, which gives us a running record of the attack surface.
• CVE severities from vulners. Vulnerabilities reported by the vulners script are imported as their own Findings, with severity derived from the CVSS score and the CVE recorded as a vulnerability ID.
• Infrastructure next to application results. Network findings sit on the same Asset as DAST and container results, so a report for a system covers what is exposed as well as what is vulnerable in code.
• Ticketing and SLAs. Unexpected exposure can be pushed to Jira and held to the same SLA rules as findings from every other tool.

How This Integration Works

DefectDojo imports Nmap results with the Nmap Scan scan type. The parser reads Nmap's XML format and rejects files whose root element is not nmaprun.

1. Run Nmap with XML output. A service scan of a range:

nmap -sV -oX nmap-report.xml 10.20.0.0/24

To include CVE matches for detected service versions, add the vulners NSE script:

nmap -sV --script vulners -oX nmap-vulners.xml 10.20.0.0/24

2. Import the XML. In the UI, open the Engagement, choose Import Scan Results, select Nmap Scan, and upload the file. To automate it, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Nmap Scan" \
  -F "file=@nmap-report.xml" \
  -F "product_name=dc-east-network" \
  -F "engagement_name=Weekly Perimeter" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Nmap Scan" \
  --report-path "./nmap-report.xml" \
  --product-name "dc-east-network" \
  --engagement-name "Weekly Perimeter" \
  --auto-create-context

3. Reimport each scan of the same range. Send later scans to /api/v2/reimport-scan/ against the same Test so closed ports are mitigated and new ones are flagged in the import history.

Data Granularity: What Gets Imported

The parser creates two kinds of Findings: one per open port, and one per vulnerability reported by the vulners script.

Two parser behaviors shape what you see. Only ports in the open state are imported, so filtered and closed ports never appear. And port Findings are grouped by port number across the whole file: port 443 open on 40 hosts becomes one Finding with 40 endpoints and a description that lists each host. vulners Findings are likewise grouped by vulnerability ID, with every affected endpoint attached.

Use Cases

For perimeter monitoring: A weekly scheduled scan of public IP ranges is reimported into one Test per range. When a new port shows up, it appears as a new Finding in that week's import, and the team can assign it to whoever owns the host before it becomes an incident.

During a cloud migration: A team moving 200 hosts tracks which legacy services are still listening on old ranges. Reimports show ports closing as services are decommissioned, which gives the migration lead a measurable burn-down instead of a spreadsheet.

As a lightweight vulnerability check: In network segments where a full vulnerability scanner isn't deployed, -sV --script vulners gives CVE matches for exposed service versions. DefectDojo turns those into Findings with severity and CVE IDs, so they can be prioritized alongside results from dedicated scanners.

For audit evidence: Segmentation and exposure reviews often ask what was reachable and when it was closed. DefectDojo keeps the discovery date, endpoints, and mitigation date for each open port Finding.

Operational Tips

• Reimport into the same Test for each range. Because port Findings combine every host into one description, the legacy hash changes whenever the set of hosts changes, while reimport matches on title and severity and keeps the history clean.
• The parser groups on port number alone, so 53/tcp and 53/udp on the same scan become one Finding titled with whichever protocol it saw first. Run TCP and UDP scans as separate imports if you need them apart.
• The parser reads each host's IPv4 address element. Test IPv6-only scans (-6) before relying on them in a pipeline.
• Open port Findings are always Info. Set an SLA for Info or use risk acceptance for expected services such as 443 on a web tier, and save stricter SLAs for vulners Findings.
• Leave minimum_severity unset for Nmap imports unless you only want vulners results, since a Low threshold drops every open port Finding.
• vulners matches are based on detected version strings, which can be wrong for backported distribution packages. Confirm before escalating, and mark false positives so they stay closed.
• Tag imports with the scan profile or range (for example tags=perimeter,weekly) so internal and external exposure can be reported separately.