ReversingLabs Integration with DefectDojo

ReversingLabs Spectra Assure Integration with DefectDojo

Spectra Assure is ReversingLabs' software supply chain security platform. Rather than scanning source code, it analyzes compiled software packages (installers, archives, and other release artifacts) along with the components and third-party dependencies inside them, looking for known vulnerabilities, malware, tampering, and other risks before software ships or is deployed. It is available as the rl-secure CLI, the Spectra Assure Portal, and the rl-scanner and rl-scanner-cloud Docker images. Each analysis produces a set of reports, including the detailed rl-json report that DefectDojo imports.

ReversingLabs Spectra Assure Integration with DefectDojo

We use Spectra Assure on the artifacts we actually release and on third-party software we bring in, because a binary can contain components that no manifest declares. DefectDojo is where the resulting CVEs get handled. Each vulnerable component or dependency becomes a Finding on the right Asset with its package URL, file path, CVSS score, and exploit status, so the team responsible for the build can see what to upgrade and the security team can hold it to an SLA. Release over release, reimports show which CVEs a new build removed.

Why ReversingLabs Spectra Assure Matters

Source-level SCA only sees what a build declares. The artifact that reaches customers can include vendored libraries, bundled runtimes, and nested packages that were never listed in a lockfile.

• Spectra Assure inspects the final package, so it catches components introduced by build tooling, installers, or third-party binaries.
• It identifies components by hash and package URL, which distinguishes two files with the same name but different contents.
• Each CVE carries exploit intelligence such as whether a fix exists, whether exploit code exists, and whether malware uses it.
• It is useful for software you don't build yourself, where you have a binary and no source.

Advantages of This Integration

What DefectDojo adds to Spectra Assure results:

• Per-component Findings. Each active CVE on each component or dependency becomes its own Finding, titled with the CVE and the package URL, so owners can fix them one upgrade at a time.
• Exploit context as tags. Exploit signals become tags such as Fix Available, Exploit Exists, Exploited by Malware, and Patching Mandated, which makes prioritization filters straightforward.
• CVSS-based severity. The CVSS base score maps onto DefectDojo's Critical to Info scale, and the score itself is stored on the Finding.
• Release history. Reimporting each new build's report into the same Test mitigates CVEs that a build removed and reactivates any that return.
• Artifact and code risk together. Binary-level CVEs sit next to SAST and source SCA findings on the same Asset, so reporting covers the whole product.

How This Integration Works

DefectDojo imports Spectra Assure results with the ReversingLabs Spectra Assure scan type. The parser accepts only the report.rl.json file. Its main job is extracting the known vulnerabilities (CVEs) listed in the report's components and dependencies sections.

1. Generate the rl-json report. With the CLI, after the package has been scanned into your package store:

rl-secure report rl-json pkg:rl/my-project/my-package@1.0.1 --output-path ./reports

This writes report.rl.json. The Portal API and the rl-scanner Docker images can produce the same report; see the Spectra Assure documentation for the option in each.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select ReversingLabs Spectra Assure, and upload the file. To automate it, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=ReversingLabs Spectra Assure" \
  -F "file=@reports/report.rl.json" \
  -F "product_name=desktop-client" \
  -F "engagement_name=Release 1.0.1" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "ReversingLabs Spectra Assure" \
  --report-path "./reports/report.rl.json" \
  --product-name "desktop-client" \
  --engagement-name "Release 1.0.1" \
  --auto-create-context

Data Granularity: What Gets Imported

Only CVEs in each item's active vulnerability list are imported. CVEs that were triaged in Spectra Assure are skipped, and no endpoints are created.

Use Cases

At release time: The build pipeline scans every release candidate with rl-secure and imports the report into an Engagement for that release. The release manager checks DefectDojo for open Critical Findings tagged Exploit Exists before signing off.

For third-party software intake: A procurement or IT security team scans vendor installers before approving them and imports each report into an Asset for that vendor. Open CVEs become questions for the vendor, tracked with due dates.

Comparing source and artifact views: A product team imports both its source SCA results and its Spectra Assure results into the same Asset. CVEs that appear only in the artifact point to bundled components the source scan can't see.

Prioritizing remediation: Filtering on the Exploited by Malware or Patching Mandated tags gives a short, defensible list to fix first, ahead of the rest of the SLA queue.

Operational Tips

• Import one report per package version into its own Test, or reimport each new version into a Test per product line if you want a running history. Pick one convention and keep it.
• Triage in Spectra Assure where you can. Triaged CVEs never reach DefectDojo, so decisions made there carry over automatically.
• The same CVE on several dependencies produces several Findings because titles include the package URL. That matches how fixes are applied, one component at a time.
• The parser stores the CVSS base score in the CVSS v3 score field whatever CVSS version the report lists. Check the version in Spectra Assure if a score looks off.
• Use minimum_severity on import for large installers that bundle many low-severity components.
• Tag imports with the package version (for example tags=1.0.1) so you can report on findings by release.