Risk Recon Integration with DefectDojo

RiskRecon Integration with DefectDojo

RiskRecon, a Mastercard company, is a third-party cyber risk platform that continuously monitors the internet-facing systems of organizations and their vendors. It discovers hosts, domains, and IP addresses attributed to a company, assesses them against security criteria such as software patching, web encryption, and hosting practices, and reports individual findings with a severity, priority, and asset value. RiskRecon exposes those findings through a REST API, which is what DefectDojo's integration reads.

RiskRecon Integration with DefectDojo

We pull RiskRecon into DefectDojo because its findings are about systems we own, and they deserve the same handling as anything our internal scanners report. RiskRecon is good at showing how our perimeter looks from the outside, the way a vendor assessor or an attacker sees it. The trouble is that the findings live in a separate portal that engineering never opens. With the Risk Recon API Importer, DefectDojo queries RiskRecon directly and turns each finding into a Finding with a date, severity, and owner, so an expired certificate or a host on shared hosting becomes a ticket rather than a line in a quarterly ratings review.

Why RiskRecon Matters

External risk ratings increasingly shape vendor reviews, cyber insurance conversations, and board reporting. The findings behind a rating are what change it.

• RiskRecon sees internet-facing assets that internal inventories miss, including systems run by other teams or forgotten after an acquisition.
• Each finding comes with a security domain and criteria, which tells you whether it is a patching, encryption, or hosting issue.
• Asset value and priority fields help separate a login page on a production domain from a parked marketing site.
• The same data describes your vendors, which is useful when third-party exposure needs to be tracked as risk you inherit.

Advantages of This Integration

What we gained by importing RiskRecon findings through DefectDojo:

• External findings become tracked work. Each RiskRecon finding becomes a DefectDojo Finding that can be assigned, commented on, pushed to Jira, and measured against SLAs.
• Filtered pulls. The import configuration filters by domain, IP address, host name, severity, priority, asset value, hosting provider, or country, so you can import only what a team is responsible for.
• Per-company scoping. Several RiskRecon companies (targets of evaluation) can be queried in one import, each with its own filters.
• Context kept with the Finding. The RiskRecon finding ID, context, value, hosting provider, security domain and criteria, asset value, priority, and first-seen date are recorded in the description, and the first-seen date becomes the Finding date.
• One view of exposure. RiskRecon Findings sit beside Nmap, DAST, and cloud findings on the same Asset, so external and internal views can be compared.

How This Integration Works

DefectDojo imports RiskRecon data with the Risk Recon API Importer scan type. Unlike most parsers, the file you upload is not a report. It is a small JSON configuration that tells DefectDojo how to reach the RiskRecon API, and DefectDojo makes the API calls during import.

1. Write the configuration file. Supply the API endpoint, your RiskRecon API key, and optional filters:

{
  "url_endpoint": "https://api.riskrecon.com/v1",
  "api_key": "REPLACE_WITH_RISKRECON_API_KEY",
  "companies": [
    {
      "name": "Example Corp",
      "filters": {
        "severity": ["critical", "high"],
        "domain_name": ["example.com"]
      }
    }
  ]
}

Each entry in companies is matched against RiskRecon's company short name and can carry its own filters. Remove companies to query every company in your RiskRecon account. Without companies, a top-level filters object applies the same filters to all of them, and it is ignored when companies is present. Remove both to retrieve everything.

2. Import the configuration. In the UI, open the Engagement, choose Import Scan Results, select Risk Recon API Importer, and upload the JSON file. Or use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Risk Recon API Importer" \
  -F "file=@riskrecon-config.json" \
  -F "product_name=external-perimeter" \
  -F "engagement_name=RiskRecon" \
  -F "auto_create_context=true"

DefectDojo Pro users can run it from a scheduled job with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Risk Recon API Importer" \
  --report-path "./riskrecon-config.json" \
  --product-name "external-perimeter" \
  --engagement-name "RiskRecon" \
  --auto-create-context

3. Reimport on a schedule. Reimporting the same configuration into the same Test refreshes it: findings RiskRecon no longer reports are mitigated and new ones are added.

The parser also accepts a file that already contains a findings array with "test": true set, in which case it reads those findings instead of calling the API. That mode is how DefectDojo's own unit tests exercise the parser.

Data Granularity: What Gets Imported

Within one import, entries with the same finding_id are collapsed into one Finding and counted as occurrences.

Use Cases

Closing the loop on a ratings review: Before a vendor assessment or renewal, the security team pulls Critical and High RiskRecon findings into DefectDojo, assigns each to the owner of the affected domain, and tracks closure against an SLA. The next pull shows what was fixed.

Splitting external findings by team: Two configuration files, each filtering on the domains one business unit owns, are imported into two different Assets. Each team sees only its own external exposure.

Monitoring acquired infrastructure: After an acquisition, a configuration filtered to the acquired company's domains brings its external findings onto a dedicated Asset, giving the integration team a concrete remediation backlog.

Operational Tips

• Treat the configuration file as a secret, because it contains your RiskRecon API key. Generate it at import time from your secret store instead of committing it to a repository.
• Start with severity filters (critical, high) and widen them once the team is keeping up, rather than importing every informational finding on day one.
• DefectDojo validates the API URL before connecting, so use the public RiskRecon endpoint rather than an internal proxy address.
• The Finding date is RiskRecon's first-seen date, which can be years old. If SLAs are counted from the Finding date, long-standing issues will import as already overdue. Plan triage accordingly.
• Reimport into one Test per configuration. Because the legacy algorithm matches on title and severity during reimport, a change in RiskRecon severity shows up as a new Finding with the old one mitigated.
• Use the tags the parser adds to group Findings by security domain in metrics and reports.