Sonatype Integration with DefectDojo

Sonatype Integration with DefectDojo

Sonatype builds software supply chain tools for open source risk. Sonatype IQ Server, the platform behind Sonatype Lifecycle (formerly Nexus Lifecycle), evaluates applications against policy and reports the open source components they contain, along with each component's security issues, license data, and match details. Application reports are available as JSON through the IQ Server REST API. Sonatype also runs OSS Index, a free service for looking up known vulnerabilities in open source components, which community tools use to audit dependencies.

Sonatype Integration with DefectDojo

We use Sonatype IQ Server to decide which open source components are allowed into our builds, and DefectDojo to track the security issues in what already shipped. Importing an IQ Server application report creates one Finding per security issue per component, on the Asset that owns the application, with the CVE or Sonatype reference, the component coordinates, and the file paths where it was found. Reimports close issues once a component is upgraded, and Sonatype results get the same SLAs and reporting as our SAST and DAST findings.

Why Sonatype Matters

Open source components make up much of what most applications ship, and their vulnerabilities are often disclosed well after the component was chosen.

• IQ Server reports identify each component by hash as well as by coordinates, and record how exact the match was.
• Security issues come from public CVEs and from Sonatype's own research, identified with references such as sonatype-2018-0035.
• Each issue carries a numeric severity score, a threat category, and, where available, a CVSS vector and CWE.
• Path names show where each component sits in the scanned artifact, such as a JAR inside WEB-INF/lib.
• IQ Server reports are organized by application and lifecycle stage. A security team still needs a single place to track remediation across tools.

Advantages of This Integration

What we gained by running Sonatype results through DefectDojo:

• Issue-level Findings. Every security issue on every component becomes its own Finding, so two CVEs in one library can be tracked, accepted, or closed independently.
• Deduplication built for components. DefectDojo hashes Sonatype Application Scan findings on title, CWE, file path, component name, component version, and vulnerability IDs, so rescanning the same application doesn't duplicate open issues.
• Upgrade tracking. Because component version is part of the hash, an upgraded library shows up as the old Finding mitigated on reimport, with any remaining issues on the new version opened separately.
• Severity from the score. Sonatype's numeric severity maps to DefectDojo's scale by CVSS-style bands, which lines up with SLA rules used for other scanners.
• Pro connector. DefectDojo Pro's Sonatype IQ connector reads every application in your IQ organization and imports the latest report for the lifecycle stage you choose.

How This Integration Works

Sonatype Application Scan (IQ Server reports). This scan type reads the raw application report JSON from IQ Server, which has a top-level components array with securityData for each component.

1. Download the raw report for an application from the IQ Server REST API:

Call the IQ Server REST API endpoint /api/v2/applications/<application-id>/reports/<report-id>/raw with an IQ user token and save the response as sonatype-report.json.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select Sonatype Application Scan, and upload the JSON. To automate it, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Sonatype Application Scan" \
  -F "file=@sonatype-report.json" \
  -F "product_name=claims-portal" \
  -F "engagement_name=IQ Build Stage" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Sonatype Application Scan" \
  --report-path "./sonatype-report.json" \
  --product-name "claims-portal" \
  --engagement-name "IQ Build Stage" \
  --auto-create-context

3. Or use the Sonatype IQ connector (DefectDojo Pro). Enter your IQ Server base URL in Location (for a Sonatype-hosted instance, https://<tenant>.sonatype.app/platform), the IQ user or user token code in Username, and the user token or password in User Token. Optionally set a Stage (such as build or release; blank means build) and a Minimum Severity. The account needs the View IQ Elements permission. Each application becomes a Record automatically, and each security issue in its latest report for that stage is imported as a finding.

Sonatype OSS Index. DefectDojo has no scan type with this exact name. OSS Index data reaches DefectDojo through the tools that query it: OssIndex Devaudit SCA Scan Importer reads JSON from Sonatype's DevAudit tool (its GitHub repository was archived in October 2025), and AuditJS Scan reads JSON from AuditJS for npm projects. The DevAudit parser bands the CVSS score into a severity, builds the title from package manager, package name, version, and CWE, and uses CWE 1035 when none is given.

Data Granularity: What Gets Imported

The table describes Sonatype Application Scan.

License data in the report is not imported, and components without security issues produce no Findings.

Use Cases

In a build pipeline: After the IQ Server policy evaluation at the build stage, the pipeline downloads the raw report and reimports it into a Test for that application. Security sees new component issues, and fixed ones are mitigated.

With DefectDojo Pro across a portfolio: An organization with hundreds of IQ applications uses the connector set to the release stage, so DefectDojo always reflects what has been released, without per-application setup.

When a new CVE is announced: Searching DefectDojo for the CVE ID lists every Asset whose Sonatype results contain it, with the owning team and component path.

Alongside other scanners: Component findings from Sonatype sit on the same Asset as SAST and container results, so application risk is reported in one place.

Operational Tips

• Choose one lifecycle stage per Test (for example build) and reimport that stage's reports, so results from different stages don't mix.
• Sonatype references such as sonatype-2018-0035 aren't stored as vulnerability IDs, only CVE-sourced issues are. Search titles when you need to find Sonatype-specific issues.
• The Mitigation field holds the IQ Server status, not fix guidance. Check the component's upgrade options in IQ Server before assigning work.
• Set minimum_severity on import, or Minimum Severity in the connector, if Low issues would bury the team.
• Use tags such as the application name and stage (for example tags=claims-portal,build) to filter reports.
• If you still rely on DevAudit for OSS Index lookups, plan a replacement, since its repository is archived and read-only.