Scantist Integration with DefectDojo
Scantist is an AI-driven DevSecOps platform that provides comprehensive software composition analysis (SCA), static application security testing (SAST), infrastructure as code scanning, application fuzzing, and code snippet traceability to identify security vulnerabilities, license compliance risks, and code quality issues across open-source components, proprietary code, and dependencies in both source code and binary formats. The platform leverages a proprietary 16TB knowledge base updated every six hours with vulnerability data from trusted advisories including NVD, CNVD, and CNNVD, delivering exploitability assessments, automated remediation recommendations, SBOM generation, and AI-powered vulnerability prioritization that eliminates 95% of security noise to enable development teams to efficiently manage software supply chain risks throughout the development lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from Scantist results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Scantist",
"engagement": "<engagement-id>",
"file": "results.json"
}