Semgrep Integration with DefectDojo

Semgrep Integration with DefectDojo

Semgrep is a static analysis tool from Semgrep, Inc. (formerly r2c). Its open source engine matches code against rules written in a syntax that looks like the code being searched, and it supports more than 30 languages. The commercial Semgrep AppSec Platform adds Semgrep Code (SAST with cross-file analysis), Semgrep Supply Chain (dependency scanning with reachability), Semgrep Secrets, and Semgrep Assistant, which adds AI guidance and triage suggestions to findings. The CLI writes results as JSON with --json, and the platform exposes findings through its REST API. DefectDojo can import both, and DefectDojo Pro can pull findings directly with a connector.

Semgrep Integration with DefectDojo

We run Semgrep in every pull request because it is fast and our engineers can read and write its rules. DefectDojo is where those results meet everything else we scan. Importing Semgrep into DefectDojo puts each rule match on the repository's Asset with a file and line, a CWE, an owner, and an SLA. Semgrep's fingerprints keep a finding stable when code moves around, so reimporting each scan shows real new issues instead of a fresh pile every time a file is reformatted.

Why Semgrep Matters

Static analysis is most useful when it runs early and its rules fit the codebase. Semgrep is built for that.

• Rules are readable and easy to customize, so teams can encode their own patterns and banned APIs alongside the public rule registry.
• Scans are fast enough to run on every commit and pull request.
• Findings include the rule message, a code snippet, CWE and OWASP metadata, and sometimes an autofix.
• The platform adds triage state, Supply Chain reachability, and Assistant guidance that help decide what to fix.
• Results scattered across pull request comments are hard to report on. Program-level questions, like how many High findings each team has open, need a central record.

Advantages of This Integration

What we gained by running Semgrep through DefectDojo:

• Stable deduplication. CLI imports use the Semgrep fingerprint as the unique ID when it is present, and fall back to the hashcode, so findings survive line shifts between scans.
• Triage state carries over. Semgrep platform JSON marks fixed and removed findings inactive and treats anything already triaged in Semgrep as verified.
• Lifecycle through reimport. Reimporting each scan into the same Test closes matches that disappeared, adds new ones, and reopens regressions.
• CWE-based reporting. All CWEs listed on a rule are stored, so Semgrep findings group with other SAST tools in CWE and OWASP views.
• Automated pulls with DefectDojo Pro. The Semgrep connector syncs findings from the Semgrep API on a schedule, with no CI changes.

How This Integration Works

There are three supported paths. The two file-based scan types are Semgrep JSON Report (CLI output) and Semgrep Pro JSON Report (findings from the Semgrep platform API).

Option 1: CLI JSON (Community Edition and DefectDojo Pro). Run a scan with JSON output:

semgrep scan --config p/default --json --output semgrep.json

Import it with the Semgrep JSON Report scan type, in the UI or with the API:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Semgrep JSON Report" \
  -F "file=@semgrep.json" \
  -F "product_name=orders-service" \
  -F "engagement_name=CI" \
  -F "auto_create_context=true"

DefectDojo Pro users can do the same with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Semgrep JSON Report" \
  --report-path "./semgrep.json" \
  --product-name "orders-service" \
  --engagement-name "CI" \
  --auto-create-context

The same scan type also reads Semgrep Supply Chain vulnerability JSON (a top-level vulns array) and reports from Opengrep, the open source Semgrep fork, which emits the same schema.

Option 2: Semgrep platform JSON. Save the findings list returned by the Semgrep API (a top-level findings array with fields such as rule_name, match_based_id, and triage_state) and import it with the Semgrep Pro JSON Report scan type, using the same API or Universal Importer commands with that scan type name.

Option 3: Semgrep connector (DefectDojo Pro). In the DefectDojo Pro UI, add a Semgrep Upstream Connector. Enter https://semgrep.dev/api/v1/ in the Location field and a Semgrep API token in the Secret field (created in Semgrep under Settings, Tokens). DefectDojo discovers your Semgrep data, maps it to Records you assign to Assets, and syncs findings on a schedule.

Data Granularity: What Gets Imported

Semgrep JSON Report (CLI)

Within one report, matches with the same rule, file, and line are merged and counted as occurrences.

Semgrep Pro JSON Report

This scan type has no per-scanner deduplication setting, so DefectDojo uses its Legacy algorithm. On reimport, Legacy matches findings on title and severity, and because the title is the rule name, several matches of one rule in a Test can match each other.

Use Cases

Pull request and main branch scans: CI runs Semgrep on every merge to main and reimports into one Test per repository. Pull request results stay in Semgrep comments, while DefectDojo tracks what actually landed on the main branch.

Custom rule rollouts: When AppSec publishes a new internal rule, the next scans surface every existing match as new findings on each Asset. Owners get SLA clocks, and progress on the rule is measurable across the organization.

Platform users on DefectDojo Pro: Teams already managing triage in Semgrep use the connector so findings, along with their triage state, arrive in DefectDojo without anyone handling exports.

Combined code and dependency view: Semgrep Code findings and Supply Chain vulnerabilities sit next to DAST and container results on the same Asset for release reviews.

Operational Tips

• Log in or use the platform when you can. Without a fingerprint, CLI findings deduplicate on a hashcode that includes the line number, so code edits above a match can create a new finding.
• Keep rule configs at a stable path. The CLI rule ID can include the config path, and it becomes the title.
• Expect the CLI parser to reject unknown severities. Custom rules should use Semgrep's standard severity values.
• Use one Test per repository and branch so reimport lifecycles stay meaningful.
• Treat Semgrep's INFO and LOW as Low in DefectDojo, and set minimum_severity if style-oriented rules add noise.
• Don't mix ingestion paths for the same repository. CLI, platform JSON, and connector findings carry different identifiers and won't deduplicate cleanly against each other.