Talisman Integration with DefectDojo

Talisman Integration with DefectDojo

Talisman is an open source tool from Thoughtworks that looks for secrets and sensitive files in Git repositories. It is usually installed as a pre-commit or pre-push hook, where it inspects outgoing changes for things like private keys, tokens, high-entropy strings, suspicious file names, and unusually large files, and blocks the commit or push if it finds them. It can also run in CLI mode with --scan to check a repository's history and write a JSON report with --reportDirectory. DefectDojo imports that JSON report.

Talisman Integration with DefectDojo

We already had Talisman stopping secrets at the developer's machine. What we lacked was any record of what it found when it scanned existing repositories, which is where old credentials actually live. Importing Talisman history scans into DefectDojo gives every flagged file a Finding on the repository's Asset, with the matching commits recorded, a severity, and an owner. Credential rotation becomes tracked work, and a rescan after cleanup shows what was really removed.

Why Talisman Matters

A secret that reaches a shared repository should be treated as exposed, even if it is deleted in the next commit. Prevention and history review both matter.

• As a Git hook, Talisman stops many secrets before they leave a laptop, which is the cheapest place to catch them.
• In scan mode it reviews commit history, which finds credentials that were committed before any hook was installed.
• It checks file names and sizes as well as content, so it catches key files and database dumps, not just strings.
• Each failure names the file, the matching commits, and a severity.
• Hook results disappear when the terminal closes. A history scan needs to be tracked until every exposed secret is rotated.

Advantages of This Integration

What we gained by sending Talisman reports through DefectDojo:

• A rotation queue. Each secret finding gets an owner and an SLA, so revoking and rotating the credential is assigned work rather than a note in chat.
• Consistent classification. Every finding is tagged with CWE-798 (use of hard-coded credentials), so secrets from Talisman group with secret findings from other scanners in reports.
• History across rescans. Reimporting a later scan into the same Test mitigates files that no longer trigger Talisman and reactivates any that return.
• Deduplication. Findings are deduplicated within each report and across imports on title, CWE, line, file path, and description.
• Context with other code findings. Secrets sit on the same Asset as SAST and SCA results for the repository, with Jira push and risk acceptance available.

How This Integration Works

DefectDojo imports Talisman results with the Talisman Scan scan type.

1. Produce a JSON report. From the root of the repository, run Talisman in scan mode and point it at a report directory:

talisman --scan --reportDirectory ./talisman-out

The report is written to talisman-out/talisman_reports/data/report.json. Talisman also offers --ignoreHistory to limit the scan to the current state of the repository instead of every commit.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select Talisman Scan, and upload report.json. To automate it, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Talisman Scan" \
  -F "file=@talisman-out/talisman_reports/data/report.json" \
  -F "product_name=billing-service" \
  -F "engagement_name=Secret Scanning" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Talisman Scan" \
  --report-path "./talisman-out/talisman_reports/data/report.json" \
  --product-name "billing-service" \
  --engagement-name "Secret Scanning" \
  --auto-create-context

3. Reimport after cleanup. Once secrets are rotated and removed or added to .talismanrc as reviewed exceptions, scan again and reimport into the same Test with /api/v2/reimport-scan/.

Data Granularity: What Gets Imported

Two parser behaviors are worth knowing. Failures with an empty commits list are skipped, so only entries Talisman ties to at least one commit become findings. And because every finding in a file shares the same title, the description (which holds the message) is what keeps several findings in one file apart.

Use Cases

Repository onboarding: When a team brings a legacy repository into the security program, a one-time history scan with Talisman is imported into its Asset. Each finding is assigned to the repository owner to rotate and remove, and the import date marks the start of the SLA.

Scheduled history checks: A nightly CI job scans the default branch and reimports. New findings mean a secret got past local hooks, which is a signal to check hook installation on that team's machines.

Incident follow-up: After a credential leak elsewhere, the security team scans affected repositories and uses the DefectDojo findings to confirm every copy of the credential was found and rotated.

Program reporting: CWE-798 findings across Talisman and other secret scanners give leadership one count of open hardcoded credentials by Asset and age.

Monorepos and shared libraries: In a large repository, findings are grouped by file path, so the owners of each directory can filter for the files they maintain and work through their own rotation list while the security team watches the overall count fall.

Operational Tips

• Limit who can view these findings. Talisman messages can contain part or all of the detected secret, and that text is stored in the finding description.
• Rotate first, then remove. Deleting a secret from the latest commit does not remove it from history, so close findings only after the credential has been revoked.
• Expect some findings to be absent. Failures without associated commits are skipped by the parser, so compare with the raw report on the first import.
• Use .talismanrc for reviewed false positives so they stop appearing in scans, and mark the matching DefectDojo findings as false positive with a note.
• Review severity before setting SLAs. Severity comes straight from Talisman's detector, which is a guess about the pattern, not a measure of what the credential grants.
• Tag imports by scan scope (for example tags=full-history or tags=head-only) so a head-only rescan isn't mistaken for a history cleanup.