SARIF Integration with DefectDojo
SARIF (Static Analysis Results Interchange Format) is an OASIS-approved standard JSON-based format designed to represent the output of static analysis tools in a comprehensive, interoperable structure that captures security vulnerabilities, code quality issues, compliance violations, and other findings detected during automated code analysis. The format enables seamless integration and aggregation of results from multiple analysis tools across diverse programming languages into unified workflows including result management systems, IDEs, CI/CD pipelines, and code scanning platforms, reducing complexity while supporting advanced scenarios such as cross-run result correlation, deterministic fingerprinting, compliance reporting, and comprehensive artifact analysis throughout the software development lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from SARIF results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "SARIF",
"engagement": "<engagement-id>",
"file": "results.json"
}