SpotBugs Integration with DefectDojo
SpotBugs is an open-source static analysis tool that analyzes Java bytecode to detect over 400 bug patterns including null pointer dereferences, infinite recursive loops, concurrency issues, resource leaks, and security vulnerabilities using pattern-based detection techniques inherited from its predecessor FindBugs. The tool integrates seamlessly into development workflows through IDE plugins for Eclipse, IntelliJ IDEA, and NetBeans, as well as build tools including Maven, Gradle, Ant, and Jenkins, providing developers with automated bug detection capabilities that help identify potential errors, performance issues, and code quality problems throughout the software development lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from SpotBugs results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "SpotBugs",
"engagement": "<engagement-id>",
"file": "results.json"
}