Openscap Integration with DefectDojo
OpenSCAP is an open-source security compliance and vulnerability scanning framework that implements the NIST-certified Security Content Automation Protocol (SCAP) standard to perform automated configuration audits, security compliance assessments, and vulnerability detection across Linux systems, containers, and infrastructure by evaluating them against industry frameworks including CIS Benchmarks, DISA STIG, PCI-DSS, HIPAA, and NIST 800-53. The platform provides command-line tools, graphical interfaces, and integration capabilities to continuously scan systems for misconfigurations and security vulnerabilities, generate detailed compliance reports with remediation scripts that can automatically perform corrective actions, and enable organizations to maintain security compliance through automated auditing across both local and remote systems throughout the development and production lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from Openscap results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Openscap",
"engagement": "<engagement-id>",
"file": "results.json"
}