OSV Scanner Integration with DefectDojo
OSV-Scanner is an open-source vulnerability scanner developed by Google that identifies security vulnerabilities affecting project dependencies by cross-referencing lockfiles, SBOMs (CycloneDX, SPDX), container images, and Git commits against the OSV.dev database, which aggregates vulnerability data from GitHub Security Advisories, PyPA, RustSec, and other sources across multiple programming languages and package managers. The tool provides layer-aware container scanning, guided remediation with upgrade recommendations, offline scanning capabilities, and comprehensive vulnerability reporting in both human-readable and machine-readable formats, integrating seamlessly into CI/CD pipelines to enable continuous security monitoring and automated dependency security management throughout the software development lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from OSV Scanner results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "OSV Scanner",
"engagement": "<engagement-id>",
"file": "results.json"
}