Nuclei Integration with DefectDojo

Nuclei Integration with DefectDojo

Nuclei is an open source, template-based vulnerability scanner from ProjectDiscovery. It sends requests to targets (HTTP, DNS, TCP, and other protocols) and matches responses against YAML templates, most of which come from the community-maintained nuclei-templates repository covering CVEs, misconfigurations, exposed panels, and default credentials. Nuclei writes results as JSON Lines or a JSON array, and scans can also be sent to ProjectDiscovery Cloud.

Nuclei Integration with DefectDojo

We use Nuclei because new templates for a fresh CVE often appear within days, and it lets us check thousands of hosts for that one issue in minutes. What Nuclei doesn't give us is a memory. Every run is a flat list of template hits. Importing into DefectDojo turns those hits into Findings on the right Asset with CVE IDs, CWEs, CVSS data, and every matched endpoint, groups repeat hits on the same host, and closes them on the next reimport once the fix is in. On DefectDojo Pro we also sync ProjectDiscovery Cloud scans directly with the connector.

Why Nuclei Matters

Nuclei is fast, scriptable, and driven by a large public template library, which makes it a common choice for external attack surface checks and rapid CVE response.

• Templates encode a specific check, so a hit usually means a concrete, reproducible condition rather than a heuristic guess.
• The community template library covers new CVEs quickly, which matters when a widely exploited bug lands on a Friday.
• Nuclei records the matched URL, the template's classification (CVE, CWE, CVSS), and often the request, response, and a curl command that reproduces the hit.
• Run against a large estate, Nuclei can produce thousands of lines of output. Without deduplication and ownership, the important hits get lost.

Advantages of This Integration

What we gained by sending Nuclei results through DefectDojo:

• Grouped hits. Within a report, hits for the same template, type, matcher, and host become one Finding with every matched endpoint attached and an occurrence count.
• Deduplication across scans. DefectDojo hashes Nuclei Findings on title, CWE, severity, and component name (the matcher name), and checks endpoints, so recurring hits are recognized.
• Classification carried over. CVE IDs, all CWEs, CVSS vector, and CVSS score from the template become Finding fields usable in filters and reports.
• Evidence for developers. The request and response are stored on the Finding, and the curl command (when present) goes into Steps to Reproduce.
• Two ways in. Import Nuclei files in Community Edition or DefectDojo Pro, or let the DefectDojo Pro connector pull scans from ProjectDiscovery Cloud on a schedule.

How This Integration Works

Option 1: file import (Community Edition and DefectDojo Pro). DefectDojo imports Nuclei output with the Nuclei Scan scan type. The parser reads both formats Nuclei writes: a JSON array (a file starting with [) or JSON Lines (one object per line).

Produce a report:

nuclei -l targets.txt -jsonl -o nuclei-report.jsonl

Or export a JSON array:

nuclei -l targets.txt -je nuclei-report.json

Import it in the UI (Engagement, Import Scan Results, Nuclei Scan) or with the API:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Nuclei Scan" \
  -F "file=@nuclei-report.jsonl" \
  -F "product_name=public-web" \
  -F "engagement_name=External Scans" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Nuclei Scan" \
  --report-path "./nuclei-report.jsonl" \
  --product-name "public-web" \
  --engagement-name "External Scans" \
  --auto-create-context

Option 2: Nuclei (ProjectDiscovery Cloud) connector (DefectDojo Pro). The connector uses the ProjectDiscovery Cloud Platform (PDCP) REST API to pull results from your account. Results reach PDCP from hosted scans or from the Nuclei CLI run with -dashboard. Configure it with:

1. https://api.projectdiscovery.io in the Location field.
2. A ProjectDiscovery Cloud API key in the Secret field, generated under Settings, API Key. A dedicated service account keeps automated activity separate.
3. Optionally, a Team ID to sync a team workspace instead of your personal one.
4. Optionally, a Minimum Severity to limit which findings are imported.

DefectDojo creates a separate Record for each PDCP scan and imports that scan's findings across every severity, including informational.

Data Granularity: What Gets Imported

The table describes the Nuclei Scan file parser.

Use Cases

Rapid CVE response: When a critical CVE gets a Nuclei template, the team scans the external estate and imports the result. Every affected host shows up as an endpoint on one Finding, assigned to the right owners within the hour, and the follow-up reimport shows which hosts are patched.

Continuous external monitoring: A scheduled Nuclei run against the public inventory reimports into a Test per environment. New exposed panels or misconfigurations appear as new Findings rather than as diffs someone has to read.

Pairing with DAST in the pipeline: Teams run a deep DAST scan nightly and a targeted Nuclei run on each deploy. Both import to the same Asset, so a regression caught by either tool follows the same workflow.

Using ProjectDiscovery Cloud: Teams scanning from PDCP use the DefectDojo Pro connector so every cloud scan becomes a Record mapped to an Asset without exporting files.

Operational Tips

• Use a curated template set (-tags, -severity, or a template directory) per target class. Running every template against everything produces informational noise that buries real hits.
• Set minimum_severity=Low on file imports to skip the info-level fingerprinting and technology detection templates if you don't track them. On the connector, use its Minimum Severity field.
• Info-severity templates still have value for inventory. If you keep them, put them in a separate Test or tag them so they don't affect metrics.
• Templates whose severity isn't one of DefectDojo's levels import as Low. Check those Findings during triage.
• The stored request and response can contain session tokens or other sensitive data from the target. Limit access to these Findings, or run Nuclei with -omit-raw to leave request and response pairs out of the report if you don't need them.
• Reimport scheduled scans into the same Test. Because matched endpoints are grouped per host, the reimport history shows exactly which hosts were fixed.