OWASP Dependency Track Integration with DefectDojo
Dependency-Track is an intelligent continuous SBOM (Software Bill of Materials) analysis platform that enables organizations to identify and reduce risk in the software supply chain by monitoring component usage across all application versions and integrating with multiple sources of vulnerability intelligence including NVD, GitHub Advisories, Snyk, and OSV. Dependency-Track provides API-first component analysis capabilities ideal for CI/CD environments, consuming and producing CycloneDX SBOMs and VEX documents while helping security teams prioritize remediation through exploit prediction scoring and comprehensive vulnerability tracking.
Data Granularity: What Gets Imported
The following fields are captured from OWASP Dependency Track results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "OWASP Dependency Track",
"engagement": "<engagement-id>",
"file": "results.json"
}