Trivy Integration with DefectDojo
Trivy is an open-source comprehensive security scanner developed by Aqua Security that detects vulnerabilities, misconfigurations, secrets, SBOM components, and license issues across container images, filesystems, Git repositories, virtual machines, Kubernetes clusters, and cloud environments by scanning operating system packages, language-specific dependencies, and infrastructure as code across 30+ programming languages and platforms. The tool integrates seamlessly into CI/CD pipelines with automatic database updates every six hours, support for air-gapped environments, and multiple output formats including JSON, SARIF, and CycloneDX/SPDX SBOM generation, enabling developers and security teams to perform fast, accurate security assessments with minimal false positives throughout the software development lifecycle from code to cloud.
Data Granularity: What Gets Imported
The following fields are captured from Trivy results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Trivy",
"engagement": "<engagement-id>",
"file": "results.json"
}