OWASP Dependency Check Integration with DefectDojo
OWASP Dependency-Check is an open-source software composition analysis (SCA) tool that identifies known security vulnerabilities in project dependencies by analyzing manifest files such as pom.xml, package.json, and requirements.txt, then cross-referencing components against the National Vulnerability Database (NVD) and other sources including NPM Audit, OSS Index, and RetireJS to detect vulnerable libraries. The tool integrates into development workflows through command-line interface, Maven, Gradle, Ant plugins, and CI/CD platforms including Jenkins, GitHub Actions, and Azure DevOps to provide automated vulnerability detection with detailed severity-rated reports that enable developers to address security risks in third-party components throughout the software development lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from OWASP Dependency Check results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "OWASP Dependency Check",
"engagement": "<engagement-id>",
"file": "results.json"
}