Scout Suite Integration with DefectDojo
Scout Suite Integration with DefectDojo
Scout Suite is an open source multi-cloud security auditing tool published by NCC Group. It gathers configuration data through each cloud provider's APIs and evaluates it against a ruleset, flagging risky settings in services such as identity and access management, storage, networking, and logging. Amazon Web Services, Microsoft Azure, and Google Cloud Platform are fully supported, with Alibaba Cloud, Oracle Cloud Infrastructure, and others in alpha. Each run produces an HTML report backed by a JavaScript results file, which is the file DefectDojo imports.
Scout Suite Integration with DefectDojo
We run Scout Suite against our cloud accounts because it gives an auditor's view of configuration without installing anything in the account, just read-only API access. The HTML report is good for a one-time review. It is poor at telling you, three weeks later, which flagged resources were fixed. Importing the Scout Suite results file into DefectDojo turns every flagged resource into its own Finding on the owning Asset, deduplicated against earlier runs, with an owner, an SLA, and a history.
Why Scout Suite Matters
Configuration mistakes in cloud accounts are common and easy to miss, because they live in API settings rather than code.
- Scout Suite checks the live state of an account, so it catches changes made in a console that never went through infrastructure as code review.
- It covers several providers with one tool and one report layout, which helps teams that run workloads in more than one cloud.
- Each flagged item points to a specific resource path, so a finding can be traced to the exact security group, bucket, or policy.
- Scout Suite stores results per run. Without a platform behind it, comparing runs to see what drifted is manual work.
Advantages of This Integration
What changed once Scout Suite results went into DefectDojo:
- One Finding per flagged resource. The parser creates a separate Finding for every item a rule flags, so a rule failing on ten resources yields ten Findings that can be fixed and closed individually.
- Stable deduplication. DefectDojo hashes Scout Suite findings on file path (the resource path Scout Suite reports) and vulnerability ID from tool (the provider code plus rule name), so the same rule on the same resource is recognized across runs.
- Drift as a delta. Reimporting each run into the same Test mitigates findings for resources that were fixed and adds anything newly flagged.
- Context on the Test. The import records the account ID, provider, ruleset, and a per-service summary of checked and flagged items in the Test description.
- SLAs and exceptions. Danger results arrive as Critical and warnings as Medium, so cloud findings follow the same SLA rules as application findings, and intentional settings can be risk-accepted with an expiration date.
How This Integration Works
DefectDojo imports Scout Suite output with the Scout Suite Scan scan type. It expects the results file Scout Suite writes alongside its HTML report, found in the scoutsuite-results/ folder of the report directory as scoutsuite_results_*.js. Upload that .js file as is. The parser strips the leading scoutsuite_results = assignment and reads the JSON that follows.
1. Run Scout Suite. For example, against an AWS account using a named CLI profile:
scout aws --profile audit-prod --report-dir ./scoutsuite-report --no-browser
Use scout azure or scout gcp with the matching authentication options for other providers. Each account or project you scan produces its own results file.
2. Import the results file. In the UI, open the Engagement, choose Import Scan Results, select Scout Suite Scan, and upload the .js file. To automate it, use the API in Community Edition or DefectDojo Pro:
curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
-H "Authorization: Token $DD_API_TOKEN" \
-F "scan_type=Scout Suite Scan" \
-F "file=@scoutsuite-report/scoutsuite-results/scoutsuite_results_aws-audit-prod.js" \
-F "product_name=aws-prod" \
-F "engagement_name=Cloud Audit" \
-F "auto_create_context=true"
DefectDojo Pro users can run the same import with Universal Importer:
universal-importer import \
--defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
--scan-type "Scout Suite Scan" \
--report-path "./scoutsuite-report/scoutsuite-results/scoutsuite_results_aws-audit-prod.js" \
--product-name "aws-prod" \
--engagement-name "Cloud Audit" \
--auto-create-context
3. Reimport on a schedule. Send each later run for the same account to /api/v2/reimport-scan/ against the same Test.
Data Granularity: What Gets Imported
| DefectDojo Field | Source in Scout Suite Results | Notes |
|---|---|---|
| Title | Rule description |
Shortened to 150 characters |
| Severity | Rule level |
danger becomes Critical, warning becomes Medium, anything else Info |
| Description | Rule rationale, item path, resource attributes |
Rationale, a Location line, then the flagged resource's configuration values |
| Mitigation | Rule remediation |
When the rule provides one |
| References | Rule references |
One per line |
| File Path | Flagged item path | Used to hold the service and resource path, since findings have no service field |
| Vulnerability ID from tool | provider_code and rule name |
For example aws: followed by the rule key |
| CWE | Fixed at 1032 | Security Configuration Weaknesses |
| Date | last_run.time |
Date of the Scout Suite run |
| Test details | Account, provider, ruleset, service summary | Written to the Test description |
| Finding type | Static | Scout Suite findings are marked static |
| Deduplication | Hashcode | File path, vulnerability ID from tool |
Use Cases
For scheduled cloud audits: A weekly job runs Scout Suite against each production account and reimports the results file. Security leads review the change since last week instead of reading the full HTML report again.
During a cloud migration: As workloads move into a new Azure subscription or GCP project, a Scout Suite run per environment shows which configurations need attention before go-live, and DefectDojo tracks them to closure.
When onboarding an acquired account: The first scan of a new AWS account can flag hundreds of resources. Importing them into a dedicated Asset lets the team triage in bulk, risk-accept intentional settings, and set SLAs on the rest.
Across providers: Teams with workloads in more than one cloud import each account or project into the Asset that owns it, so cloud findings appear next to code and container findings for the same application.
Operational Tips
- Map one cloud account, subscription, or project to one Asset, and reimport into a stable Test for it. That keeps ownership clear and gives you automatic mitigation.
- Review the severity mapping before setting SLAs. Every danger-level rule becomes Critical regardless of the resource, so lower-impact checks may need adjusting during triage.
- Results that are not danger or warning arrive as Info. Set
minimum_severity=Lowon import if you only want actionable items. - The resource path doubles as the dedupe key. If a resource is renamed or recreated with a new ID, expect the old Finding to be mitigated and a new one opened.
- Use a custom Scout Suite ruleset if the default flags checks that don't apply to you. Changing it at the source keeps noise out of DefectDojo.
- Tag imports with provider and environment (for example
tags=aws,prod) so dashboards can be filtered by cloud.