Red Hat Integration with DefectDojo

Red Hat Integration with DefectDojo

Red Hat makes two products that DefectDojo reads security data from. Red Hat Satellite is the systems management platform for Red Hat Enterprise Linux fleets, built on the upstream Foreman and Katello projects, and it tracks which errata (security, bug fix, and enhancement advisories) apply to each registered host. Red Hat Quay is a container registry, with Project Quay as its open source upstream and quay.io as the hosted service, and it scans stored images with its built-in Clair scanner. Both expose their results as JSON through REST APIs.

Red Hat Integration with DefectDojo

We use Satellite to patch our RHEL hosts and Quay to store our images, and both know about vulnerabilities that nobody outside the platform team sees. Bringing that data into DefectDojo turns RHSA errata and image CVEs into Findings on the Assets that own those hosts and images, with Red Hat advisory IDs, CVEs, fix availability, and SLA timers. Teams can import exported JSON files, and DefectDojo Pro adds connectors that pull from Satellite and Quay on a schedule.

Why Red Hat Matters

For organizations that run on RHEL and containers, Red Hat's own data is the most direct source of truth about what needs patching.

• Satellite knows which errata are applicable to which hosts and whether the fix is installable from the content the host can reach.
• Red Hat errata IDs (RHSA, RHBA, RHEA) link each issue to Red Hat's advisory and its CVEs.
• Quay's Clair scanner reports CVEs per package for every scanned image manifest, with the fixed version when one exists.
• Neither console is where application owners track remediation alongside their code, dependency, and DAST findings.

Advantages of This Integration

What we gained by routing Red Hat data through DefectDojo:

• Errata as tracked work. Each applicable erratum becomes a finding with its severity mapped from Red Hat's rating, its CVEs and errata ID stored as vulnerability IDs, and a flag showing whether a fix is installable.
• Image CVEs with stable identity. Quay findings use the advisory ID plus package name as the tool's unique ID, so the same CVE in the same package is recognized across scans.
• File and API data that agree. The Quay file parser reports the same scan type as the DefectDojo Pro Quay connector, so a team that starts with file uploads and later enables the connector gets one set of findings, not two.
• Scheduled sync with DefectDojo Pro. The Satellite and Quay connectors discover hosts and repositories and keep findings current without anyone exporting JSON.
• Lifecycle, SLAs, and ticketing. Reimports and syncs close what was fixed, and every finding can be assigned, risk-accepted, or pushed to Jira.

How This Integration Works

DefectDojo provides two scan types for Red Hat data:

• Red Hat Satellite for JSON errata data retrieved through the Satellite REST API.
• Quay - Connectors Import for a Quay container security report in JSON, the Clair-shaped output of Quay's image security endpoint.

Option 1: File import (Community Edition and DefectDojo Pro). For Satellite, request errata from the Katello API and save the response. The parser reads the results array, so make sure the file contains every page you want:

curl "https://satellite.example.com/katello/api/errata?per_page=1000" \
  -u "$SATELLITE_USER:$SATELLITE_PASSWORD" > satellite-errata.json

For Quay, request the security report for an image manifest with vulnerabilities included:

curl "https://quay.example.com/api/v1/repository/acme/payments-api/manifest/$MANIFEST_DIGEST/security?vulnerabilities=true" \
  -H "Authorization: Bearer $QUAY_TOKEN" > quay-security.json

Then import either file in the UI (Import Scan Results on the Engagement) or through the API:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Red Hat Satellite" \
  -F "file=@satellite-errata.json" \
  -F "product_name=rhel-fleet" \
  -F "engagement_name=Errata" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Quay - Connectors Import" \
  --report-path "./quay-security.json" \
  --product-name "payments-api" \
  --engagement-name "Registry Scans" \
  --auto-create-context

Option 2: Connectors (DefectDojo Pro). The Red Hat Satellite connector imports errata from your Satellite inventory. Enter the server URL in Location and a user with the view_hosts and view_content_views permissions in Username and Password (Satellite uses HTTP Basic authentication). Optionally choose Asset Grouping (host-collection, the default, lifecycle-environment, content-view, or host), enable Skip TLS Verification for a self-signed Satellite certificate, and set a Minimum Severity. Every applicable erratum on every host becomes a finding, including bug fix and enhancement advisories.

The Quay connector uses the Project Quay REST API. Enter the HTTPS base URL in Location and an OAuth 2 access token with at least the Read repositories scope in Secret. Optionally restrict discovery to one Namespace and set a Minimum Severity. Each repository becomes a Record. On each sync DefectDojo reads the Clair report for every active tag's manifest, scanning a manifest shared by several tags once and skipping manifests Clair has not finished scanning.

Data Granularity: What Gets Imported

Red Hat Satellite creates one finding per erratum in the file:

Quay - Connectors Import creates one finding per package and advisory pair:

Use Cases

For RHEL patch programs: Operations teams sync Satellite through the DefectDojo Pro connector grouped by lifecycle environment, so production and development hosts land in separate Records with their own open errata and SLA status.

For registry hygiene: A platform team connects Quay with DefectDojo Pro and maps each repository to the Asset of the service it builds, so application teams see their image CVEs without logging into the registry.

In restricted networks: Teams that cannot grant API credentials to DefectDojo export Quay security reports and Satellite errata as JSON and upload them, keeping the same scan types the connectors use.

For audits: RHSA findings keep their discovery date and closure history in DefectDojo, so teams can show how quickly critical Red Hat advisories were applied.

Operational Tips

• Watch the Satellite description. It is part of the dedupe hash and includes host available and applicable counts, so when the number of affected hosts changes, a file reimport can see the erratum as new.
• Satellite file imports do not record which hosts an erratum applies to, only the counts. Use the DefectDojo Pro connector's host grouping when you need per-host Records.
• Filter out bug fix and enhancement errata if you only track security advisories. With file imports they arrive as Low, so minimum_severity=Medium drops them (along with security errata Red Hat rates Low); with the connector, set Minimum Severity.
• Include a top-level tag field in Quay exports when you can. Clair's output does not carry the image tag, and the parser adds it to the description only when the export supplies it.
• Use one Test per Quay repository or image stream and reimport into it, so fixed CVEs close cleanly.
• Treat the Satellite password and Quay token as secrets in your CI store, and use dedicated read-only accounts for DefectDojo.