OpenVAS Integration with DefectDojo

OpenVAS Integration with DefectDojo

OpenVAS is the open source network vulnerability scanner developed by Greenbone. It runs inside the Greenbone stack (Greenbone Community Edition or a Greenbone Enterprise appliance), where the gvmd manager schedules scan tasks and OpenVAS executes Network Vulnerability Tests (NVTs) against hosts and their services. Each result names the host, port, NVT, severity, and Quality of Detection (QoD), and reports can be downloaded from Greenbone in XML or CSV for import into DefectDojo.

OpenVAS Integration with DefectDojo

We scan our server and network ranges with OpenVAS because it is free, self-hosted, and has a large NVT feed, and we send the results to DefectDojo because a Greenbone report by itself doesn't tell anyone what to fix first. In DefectDojo, each OpenVAS result becomes a Finding on the Asset that owns those hosts, with the host and port attached as an endpoint. Repeat detections on the same endpoint collapse into one Finding, and the next scan closes what was patched instead of handing us another 400-row report.

Why OpenVAS Matters

Network scanning is still the fastest way to find missing patches, exposed services, and weak configurations on infrastructure that no application team claims.

• The NVT feed covers operating systems, network services, and common server software.
• Results carry CVE references, CVSS data, and a solution type, which gives triage a starting point.
• QoD tells you how confident the detection is, separating version-banner guesses from confirmed checks.
• Raw Greenbone output is organized per task and per report. Tracking a single vulnerability across months of scans, and across hosts, is hard without a platform behind it.

Advantages of This Integration

What we got from running OpenVAS results through DefectDojo:

• No duplicates from repeat detections. OpenVAS can report the same NVT several times on one host (two vulnerable runtimes, for example). The v2 parser combines results with the same endpoint, title, NVT OID, and severity into one Finding, counts the occurrences, and keeps each detection's output in Steps to Reproduce.
• Hashcode deduplication across scans. DefectDojo deduplicates the OpenVAS Parser v2 scan type on title, severity, vulnerability ID from tool (the NVT OID), and endpoints, so the weekly scan doesn't duplicate last week's results.
• Reimport lifecycle. Reimporting each scan into the same Test mitigates findings that disappeared after patching and reactivates any that came back.
• Fix availability. The parser flags findings as having a fix available when the Greenbone solution text says to update to a version or that the vendor has released updates, which helps separate "patch now" work from findings that need a workaround.
• Pro connector option. In DefectDojo Pro, the OpenVAS / Greenbone connector pulls each task's latest report directly from gvmd, so no one has to export files by hand.

How This Integration Works

DefectDojo offers two file scan types: OpenVAS Parser v2 and the legacy OpenVAS Parser. The documentation says only version 2 should be used going forward, and the rest of this page describes it. The parser picks CSV or XML handling from the file extension, so keep the .csv or .xml suffix.

1. Export the report from Greenbone. Open the finished report in the Greenbone web interface and download it in XML or CSV (results) format.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select OpenVAS Parser v2, and upload the file. To automate it, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=OpenVAS Parser v2" \
  -F "file=@openvas-dmz.xml" \
  -F "product_name=dmz-servers" \
  -F "engagement_name=Weekly Network Scan" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "OpenVAS Parser v2" \
  --report-path "./openvas-dmz.xml" \
  --product-name "dmz-servers" \
  --engagement-name "Weekly Network Scan" \
  --auto-create-context

3. Or connect Greenbone directly (DefectDojo Pro). The OpenVAS / Greenbone connector talks to gvmd over the Greenbone Management Protocol (GMP), carried over SSH (the right choice for current Greenbone versions) or the older TLS listener on port 9390. You provide the Greenbone host, a GMP username and password, optionally a minimum severity, and the transport details, such as an SSH key and the host key fingerprints. The connector enumerates scan tasks, makes each task a Record, and imports one finding per result from the task's latest finished report.

XML or CSV? The two formats are parsed as consistently as possible, with a few differences: EPSS score and percentile come only from CSV, CVSS vectors come only from XML, the CSV CVSS score is always stored as CVSS v3, and CSV references never contain URLs.

Data Granularity: What Gets Imported

Use Cases

For recurring infrastructure scans: A weekly Greenbone task covers a server subnet. Each report is reimported into the same Test, so the security team reviews only what changed: new findings, patched findings mitigated, and anything that regressed.

For patch campaigns: Filtering the Asset's findings by NVT title shows every host still affected by, say, an outdated OpenSSH version. An infrastructure lead assigns them to the server team and watches the count drop as each rescan mitigates patched hosts.

With DefectDojo Pro and many Greenbone tasks: Teams running dozens of tasks use the connector, map each task's Record to the Asset that owns the network segment, and let findings sync on a schedule.

During audits: Network findings keep their discovery date, SLA status, and closure history, so evidence of how long a Critical service vulnerability stayed open is already in DefectDojo.

Operational Tips

• Use OpenVAS Parser v2 for every new setup. The legacy OpenVAS Parser uses the legacy deduplication algorithm and the older field mapping.
• Pick one export format per task and stick with it. XML gives you CVSS vectors and reference URLs, CSV gives you EPSS data, and mixing them changes what appears on the same Finding.
• Greenbone's Log level results arrive as Info. Set minimum_severity=Low on import if you don't want informational detections in the Test.
• Map one network segment or environment to one Asset and reimport into a stable Test per scan task, so endpoint history stays in one place.
• Use QoD in the description to spot low-confidence detections during triage and mark confirmed false positives instead of deleting them.
• Keep hostnames resolvable in Greenbone. The parser prefers hostname over IP for the endpoint, and a host that flips between the two can look like a new endpoint.