Openscap Integration with DefectDojo

OpenSCAP Integration with DefectDojo

OpenSCAP is an open source implementation of the Security Content Automation Protocol (SCAP), a set of standards maintained by NIST. Its command-line scanner, oscap, evaluates Linux systems against XCCDF benchmarks and OVAL definitions: hardening profiles such as those from the SCAP Security Guide project, and vulnerability feeds such as Red Hat's OVAL security advisory data. The project is led by Red Hat with community contributors, and the scanner writes XML result files that DefectDojo imports.

OpenSCAP Integration with DefectDojo

We run OpenSCAP with DefectDojo because a compliance scan produces a long XML file and a pass percentage, and neither one tells an engineer what to fix next. Imported into DefectDojo, every failed rule becomes a Finding attached to the host it was evaluated on, with the rule title, the OVAL check that failed, any CVE identifiers, and a severity. When we fix a configuration and rescan, reimport closes the Findings that now pass, which gives us a hardening backlog that actually shrinks.

Why OpenSCAP Matters

Configuration drift and unpatched packages on servers are some of the most common ways into an environment, and SCAP content describes both in a standard, auditable way.

• XCCDF profiles map to recognized baselines, so a failed rule can be traced to the control it supports.
• OVAL vulnerability definitions from distribution vendors check installed packages against security advisories, which turns an advisory feed into per-host results.
• OpenSCAP is free, scriptable, and runs locally on the system being assessed, which suits regulated and air-gapped environments.
• On its own, a results file is a point-in-time snapshot. It doesn't track who owns a failed rule, whether it was accepted as an exception, or how long it has been failing.

Advantages of This Integration

What we gained by importing OpenSCAP results through DefectDojo:

• Failures only. The parser imports rule results of fail and ignores pass, not applicable, and not selected results, so the Asset shows work rather than a full benchmark dump.
• Per-host endpoints. The scanned system's target name and addresses become endpoints on each Finding, so you can see which hosts fail which rules.
• CVE tracking for OVAL advisories. Rule results carrying CVE identifiers set them as vulnerability IDs, which lets you filter compliance and vulnerability results by CVE.
• A remediation lifecycle. Reimporting a new scan into the same Test mitigates rules that now pass and reactivates any that fail again.
• Exceptions on record. Rules that can't be applied on a given host can be risk-accepted with a justification and expiry instead of being silently excluded from the profile.

How This Integration Works

DefectDojo imports OpenSCAP results with the Openscap Vulnerability Scan scan type. The parser expects an XCCDF results document: the root element must be an XCCDF Benchmark in the http://checklists.nist.gov/xccdf/ namespace, containing a TestResult. That is the file oscap xccdf eval --results writes. ARF output (--results-arf) uses a different root element and is not accepted by this parser.

1. Run an evaluation and save XCCDF results. For example, against a SCAP Security Guide data stream:

oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis \
  --results openscap-results.xml \
  /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

Profile IDs and content paths vary by distribution and package version. Use oscap info on the content file to list the profiles it contains.

2. Import the results. In the UI, open the Engagement, choose Import Scan Results, select Openscap Vulnerability Scan, and upload the XML. With the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Openscap Vulnerability Scan" \
  -F "file=@openscap-results.xml" \
  -F "product_name=rhel-web-fleet" \
  -F "engagement_name=CIS Hardening" \
  -F "auto_create_context=true"

DefectDojo Pro users can use Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Openscap Vulnerability Scan" \
  --report-path "./openscap-results.xml" \
  --product-name "rhel-web-fleet" \
  --engagement-name "CIS Hardening" \
  --auto-create-context

3. Reimport after remediation into the same Test, one Test per host or per host group and profile.

Data Granularity: What Gets Imported

Within one file, failed results that share the same check references are merged into one Finding.

Use Cases

Server hardening programs: An operations team evaluates its RHEL fleet against a CIS profile each week and reimports into one Test per host group. Failed rules are assigned to the owning team, and the reimport history shows the backlog shrinking.

Patch verification with OVAL: Evaluating hosts against a vendor's OVAL advisory content produces a Finding per unpatched advisory with CVE IDs attached. After a patch window, reimport shows which advisories are now resolved on which hosts.

Audit preparation: Auditors asking for evidence of baseline compliance can see each failed control, who owns it, any approved exceptions with expiry dates, and when each failure was closed.

Golden image checks: A platform team scans base images before publishing them and imports the results to a dedicated Asset, so failed rules are fixed in the image instead of on every server built from it.

Operational Tips

• Use one Test per host (or per identical host group) and profile. Mixing profiles in one Test makes reimport mitigate rules that simply weren't evaluated.
• target-address often lists every interface address, including loopback such as 127.0.0.1. Expect those addresses as endpoints, and filter on the host name in reports.
• If a rule result has no severity attribute, it imports as Medium. Content from SCAP Security Guide generally sets severities, but custom content may not.
• Only fail results are imported, so error and unknown results (for example, checks that couldn't run without root) are silently skipped. Generate an HTML report alongside the XML (add --report openscap-report.html to the eval command) and review it when the failure count looks too low.
• Use risk acceptance with an expiry for rules you intentionally don't apply, rather than tailoring them out of the profile, so the exception stays visible.
• Tag imports with the profile and benchmark version (for example tags=cis,rhel9) so results from different baselines can be reported separately.