Sysdig Integration with DefectDojo

Sysdig Integration with DefectDojo

Sysdig is a cloud security company whose Sysdig Secure platform covers container image scanning, Kubernetes and cloud posture, and runtime threat detection; the company also created the open source Falco project. Sysdig Secure scans images in pipelines and registries and evaluates running workloads, including whether a vulnerable package is actually loaded at runtime ("in use"). Its reporting feature exports Pipeline, Registry, and Runtime vulnerability reports as CSV or JSON, which DefectDojo imports. DefectDojo Pro can also read findings directly from Sysdig Secure's vulnerability management API with a connector.

Sysdig Integration with DefectDojo

We use Sysdig to see what is actually running in our clusters, and DefectDojo to manage the remediation work across every scanner we own. A Sysdig runtime report tells us which CVEs are in which workload in which namespace. Imported into DefectDojo, each one becomes a Finding with that Kubernetes context attached as tags, placed on the Asset that owns the workload, with an SLA and an owner. The same image CVE can then be compared with what our SCA and SAST tools report for the source code behind it. On DefectDojo Pro, the Sysdig Secure connector replaces scheduled report downloads with an account-wide sync.

Why Sysdig Matters

Container images ship hundreds of packages, and most image scanners report every CVE in every one of them. Sysdig adds runtime context that helps decide what to fix first.

• Runtime reports tie each vulnerability to a cluster, namespace, workload, and container, which answers "where is this running?" directly.
• The in-use flag separates packages that are loaded at runtime from ones that are only present on disk.
• Pipeline and registry reports catch problems before deployment, so the same CVE can be tracked from build to production.
• Reports include CVSS data, exploit availability, and fix versions.
• Exported reports are snapshots. Without a system tracking them, nobody knows whether last month's critical runtime CVEs were fixed or just redeployed.

Advantages of This Integration

What we gained by sending Sysdig reports through DefectDojo:

• Runtime context as tags. CSV imports tag each finding with cluster, namespace, workload, package, version, in-use status, and vulnerability ID, so filtering by namespace or "InUse:True" takes one click.
• Risk acceptance carries over. CSV rows marked as risk accepted in Sysdig arrive in DefectDojo already risk accepted.
• Lifecycle through reimport. Reimporting the next scheduled report into the same Test closes CVEs that are no longer present and reopens ones that come back.
• CVSS for prioritization. For CVSS v3 entries, the CSV import stores the score and the vector on the finding.
• Account-wide sync on DefectDojo Pro. The Sysdig Secure connector pulls runtime, registry, and pipeline results from the vulnerability management API and groups runtime results into Assets by cluster, namespace, workload, or image.
• One SLA policy. Sysdig severities map onto DefectDojo's scale, so container CVEs are measured against the same SLAs as findings from other tools.

How This Integration Works

DefectDojo imports Sysdig Secure reports with the Sysdig Vulnerability Report scan type. The parser handles Pipeline, Registry, and Runtime reports, in both the older and the 2025 column layouts, as CSV or as the JSON report downloaded from the Sysdig UI. It decides between CSV and JSON by file extension.

1. Export a report. In Sysdig Secure, create a vulnerability report (Pipeline, Registry, or Runtime) from the reporting section and download it as CSV or JSON. Sysdig CLI Scanner output is a different format and has its own scan type, Sysdig CLI Report; the parser rejects CLI files with a message saying so.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select Sysdig Vulnerability Report, and upload the file. To automate it, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Sysdig Vulnerability Report" \
  -F "file=@sysdig-runtime-report.csv" \
  -F "product_name=payments-platform" \
  -F "engagement_name=Runtime Vulnerabilities" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Sysdig Vulnerability Report" \
  --report-path "./sysdig-runtime-report.csv" \
  --product-name "payments-platform" \
  --engagement-name "Runtime Vulnerabilities" \
  --auto-create-context

3. Reimport each report run. Sysdig reports can be scheduled. Send each new file to /api/v2/reimport-scan/ against the same Test so the findings follow what is currently deployed.

Option: Sysdig Secure connector (DefectDojo Pro). Copy an API token from Settings > Sysdig Secure API Token in Sysdig Secure and note your region URL. Then add a Sysdig Secure connector in DefectDojo Pro and set:

• Location: your Sysdig region or base URL (for example https://us2.app.sysdig.com, https://eu1.app.sysdig.com, or an on-premises host).
• Secret: the API token.
• Scopes (optional): a comma-separated list of runtime, registry, and pipeline. Blank means runtime only.
• Runtime Asset Grouping (optional): cluster, namespace, workload, or image. Blank means namespace. Registry and pipeline results always group by image repository.
• Minimum Severity (optional): limits which findings are imported.

Each asset grouping becomes a Record, and the connector syncs on a schedule.

Data Granularity: What Gets Imported

CSV reports

JSON reports

Both formats use default deduplication on title, CWE, line, file path, and description.

Sysdig Secure connector (DefectDojo Pro). For each scan result in the configured scopes, the connector imports every vulnerable package as a finding. Runtime findings are recorded as dynamic and tagged with their Kubernetes cluster, namespace, workload, and container context. Registry and pipeline findings are recorded as static image-scan findings. Sysdig's NEGLIGIBLE severity maps to Info.

Use Cases

Prioritizing runtime exposure: A platform team imports the weekly Runtime report and filters DefectDojo on the InUse:True tag and Critical severity. That short list goes to Jira first, while CVEs in packages that never load wait for the next base image refresh.

Tracking a CVE from build to cluster: Pipeline reports are imported into a CI Engagement and Runtime reports into a production Engagement on the same Asset. When a CVE appears in both, the team can see whether a fixed image has actually rolled out.

Namespace ownership: Teams that own specific namespaces filter by their Namespace: tag and get their own remediation queue without a separate Sysdig view.

Audit evidence: Container vulnerability history, risk acceptances, and closure dates are kept per finding, which supports reviews that ask how runtime vulnerabilities are handled.

Operational Tips

• Check that every CSV row starts with a CVE. The parser requires the first column of each row to begin with "CVE" and fails the import otherwise, so filter out non-CVE identifiers (such as vendor advisories) before uploading.
• Make sure the CVSS version column is populated. In CSV imports, rows with an empty or non-numeric CVSS version are skipped, so spot-check counts against the Sysdig report.
• Prefer CSV for runtime work. It sets tags, file paths, CVSS v3 data, risk acceptance, and the dynamic flag, which the JSON reader does not.
• Keep one report type per Test. Mixing Pipeline and Runtime reports in one Test makes reimport close findings that still exist in the other context.
• Expect title changes in JSON imports when the fix version changes, because the fix version is part of the title.
• Use minimum_severity=Low to drop Negligible CVEs if they flood the Test. With the connector, set its Minimum Severity field instead.
• Choose the connector's Runtime Asset Grouping to match ownership. If teams own namespaces, keep the namespace default; if they own services across namespaces, workload gives each its own Record.
• Add registry and pipeline to the connector's Scopes only if you want pre-deployment results. The default runtime scope covers deployed workloads only.