Rusty Hog Integration with DefectDojo

Rusty Hog Integration with DefectDojo

Rusty Hog is an open source suite of secret scanners written in Rust and published by New Relic. Based on the approach of TruffleHog, it searches for credentials, keys, and other sensitive strings using regular expressions and entropy checks. Each scanner in the suite targets a different source: Choctaw Hog scans Git history, Duroc Hog scans directories, files, and archives, Gottingen Hog scans Jira issues, and Essex Hog scans Confluence pages. Every hog writes JSON, and DefectDojo imports the output of those four.

Rusty Hog Integration with DefectDojo

We run Rusty Hog with DefectDojo because a leaked credential isn't fixed when someone deletes the line. It is fixed when the secret has been rotated, and somebody has to track that. Rusty Hog finds the secrets across repositories, file shares, and the Jira tickets and Confluence pages where people paste things they shouldn't. DefectDojo turns each hit into a High severity Finding with the location, the commit or page it came from, and a clear owner, and it stays open until a rescan no longer sees it and the rotation is recorded.

Why Rusty Hog Matters

Secrets end up in more places than source code, and a scanner that only looks at Git misses the rest.

• Choctaw Hog walks commit history, so a key removed in the latest commit but still present in an earlier one is still reported.
• Duroc Hog covers build artifacts, configuration directories, and archives that never pass through version control.
• Gottingen Hog and Essex Hog cover Jira and Confluence, where credentials are often shared during troubleshooting and then forgotten.
• Secret findings are binary in impact. One exposed production key can matter more than a hundred medium-severity code findings, so every hit needs follow-through.

Advantages of This Integration

What we gained by importing Rusty Hog through DefectDojo:

• Every source in one queue. Results from Git, file system, Jira, and Confluence scans land on the owning Asset as Findings with the same workflow.
• Automatic scanner detection. With the Rusty Hog Scan type, DefectDojo identifies which hog produced the file from its fields and names the Test accordingly.
• Consistent priority. Every Rusty Hog Finding imports as High, so secret exposure falls under a strict SLA by default.
• Deduplication on location and secret. DefectDojo hashes on file path and payload (the matched string), so the same secret in the same file is recognized across scans.
• Rotation tracking. Findings can be assigned, annotated with the rotation ticket, pushed to Jira, and closed when a reimport no longer reports them.

How This Integration Works

The parser offers five scan types:

• Rusty Hog Scan detects the scanner automatically: commit fields mean Choctaw Hog, linenum or diff means Duroc Hog, issue_id or location means Gottingen Hog, and page_id means Essex Hog.
• Choctaw Hog Scan, Duroc Hog Scan, Gottingen Hog Scan, and Essex Hog Scan name the scanner explicitly. If the file doesn't match (for example a Choctaw Hog import without commitHash), the import fails with an error saying the wrong scan type was chosen.

DefectDojo's docs recommend reimporting into the same Test when you use Rusty Hog Scan.

1. Run a hog with JSON output. For a Git repository and a directory:

choctaw_hog --outputfile choctaw-report.json /path/to/repo
duroc_hog --outputfile duroc-report.json /srv/app/config

Each hog scans one target per run. For whole Jira projects or Confluence spaces, DefectDojo's docs point to the community Rusty-Hog-Wrapper project, which runs many scans and merges the results into one importable file (this is not an official DefectDojo recommendation).

2. Import the file. In the UI, open the Engagement, choose Import Scan Results, select the scan type, and upload the JSON. With the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Choctaw Hog Scan" \
  -F "file=@choctaw-report.json" \
  -F "product_name=payments-api" \
  -F "engagement_name=Secret Scanning" \
  -F "auto_create_context=true"

DefectDojo Pro users can use Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Choctaw Hog Scan" \
  --report-path "./choctaw-report.json" \
  --product-name "payments-api" \
  --engagement-name "Secret Scanning" \
  --auto-create-context

Data Granularity: What Gets Imported

Use Cases

Pre-merge Git scanning: Choctaw Hog runs against each repository on a schedule and reimports into a Test per repository. A newly committed key shows up as a new High Finding, assigned to the repository owner with the commit hash in the description.

Auditing collaboration tools: A security team runs Gottingen Hog and Essex Hog across its Jira projects and Confluence spaces each quarter. Each pasted credential becomes a Finding with a direct link to the issue or page, and the team tracks rotation and redaction to closure.

Checking build artifacts: Duroc Hog scans release archives and deployment configuration before they are published. Findings tied to the artifact path give release managers a concrete stop list.

Incident response: After a suspected leak, scanning every repository and space and importing into one Engagement shows where the credential appeared and what else was exposed alongside it.

Operational Tips

• The payload field stores the matched string, so DefectDojo will hold the secret value. Restrict who can view these Findings, and rotate every confirmed secret rather than relying on the Finding as a record of it.
• Choose the explicit scan type when you know the hog. It makes the wrong-file case fail loudly instead of guessing, and it keeps Test names predictable.
• Removing a secret from the latest commit doesn't remove it from history, and Choctaw Hog will keep reporting it. Rotate the credential and then risk-accept or close the Finding with a note, or rewrite history if your policy requires it.
• Because the hash uses file path and payload, a rotated secret that is committed again in the same file shows up as a new Finding. That is usually what you want.
• Email addresses and other low-value matches can be noisy. Use Rusty Hog's allowlist options to exclude known patterns, and mark the rest as false positives so they stay closed.
• Every Finding is High by design. If your SLA policy treats test credentials differently, record that by adjusting severity during triage with a justification.