Synopsys Coverity Integration with DefectDojo
Synopsys Coverity is a comprehensive static application security testing (SAST) solution that performs deep source code analysis across 22 programming languages and over 200 frameworks to identify security vulnerabilities, code quality defects, and compliance violations by testing every line of code and potential execution path with patented accuracy techniques that minimize false positives. The platform provides full path coverage analysis with actionable remediation guidance integrated into IDEs, CI/CD pipelines, and developer workflows, delivering compliance reporting aligned with OWASP Top 10, MISRA, CERT C/C++, PCI-DSS, and functional safety standards to enable development teams to build secure, high-quality software throughout the software development lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from Synopsys Coverity results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Synopsys Coverity",
"engagement": "<engagement-id>",
"file": "results.json"
}