Trustwave Integration with DefectDojo

Trustwave Integration with DefectDojo

Trustwave is a cybersecurity and managed security services provider whose offerings include vulnerability scanning of customer networks, hosts, and web-facing services. Scan results can be exported from Trustwave's portal as CSV with one row per vulnerability on a target. Trustwave's Fusion platform, the cloud platform behind its managed services, also exposes findings through an API that returns JSON. DefectDojo has a parser for each format.

Trustwave Integration with DefectDojo

When vulnerability scanning is delivered as a managed service, the results tend to live in the provider's portal while the fixes happen somewhere else. We import Trustwave findings into DefectDojo so they land on the same Assets as our own scanner and pentest results. Each vulnerability becomes a Finding with the affected host and port, the remediation Trustwave recommends, and an owner and SLA on our side. When the next scan comes back clean for a host, reimporting closes the Finding, and the history stays with the Asset rather than in a portal export. On DefectDojo Pro, the Trustwave Fusion connector can pull Fusion findings on a schedule, so nobody has to save API responses by hand.

Why Trustwave Matters

Managed scanning gives organizations coverage they may not have the staff to run themselves, especially across external perimeters and compliance scopes.

• Trustwave scans cover networks and internet-facing services that internal teams may not scan on a regular schedule.
• Findings include a description, remediation guidance, and, where applicable, a CVE, which is enough to hand to an infrastructure owner.
• The Fusion API gives structured JSON with locations, CVEs, and asset CPEs, which is easier to automate than a manual export.
• A provider's portal shows the provider's view. Tracking fixes alongside internal tools still needs a platform the security team controls.

Advantages of This Integration

What we gained by routing Trustwave results through DefectDojo:

• Endpoints on every Finding. The CSV parser builds an endpoint from the domain (or IP), port, and protocol, and the Fusion parser uses the finding URL, domain, or IP, so each Finding points at a specific service.
• CVE tracking. CVEs from either format are stored as vulnerability IDs, which lets DefectDojo filter and report on exposure to a specific vulnerability.
• Consolidated Fusion results. Fusion findings with the same severity, title, and description are merged into one Finding with every affected location attached.
• One remediation workflow. Trustwave Findings can be assigned, held to SLAs, risk-accepted, and pushed to Jira like any other result.
• Reimport lifecycle. Importing each new scan into the same Test mitigates Findings that no longer appear and reactivates any that return.
• Scheduled Fusion sync (DefectDojo Pro). The Trustwave Fusion connector imports findings for a tenant and creates a Record for each asset the findings reference.

How This Integration Works

DefectDojo has two scan types for Trustwave data:

• Trustwave Scan (CSV) reads Trustwave vulnerability scan exports. The parser expects the 13 columns Status, IP, Target Name, Domain, Vulnerability Name, Description, Remediation, Protocol, Port, Severity, CVE, Service, and Evidence.
• Trustwave Fusion API Scan reads JSON returned by the Trustwave Fusion API, with findings in a top-level items array.

1. Get the report. Export the scan results as CSV from Trustwave, or save the JSON returned by the Fusion API for your findings.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select the matching scan type, and upload the file. For automation, use the import API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Trustwave Scan (CSV)" \
  -F "file=@trustwave-scan.csv" \
  -F "product_name=external-perimeter" \
  -F "engagement_name=Trustwave Quarterly Scan" \
  -F "auto_create_context=true"

DefectDojo Pro users can do the same with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Trustwave Fusion API Scan" \
  --report-path "./trustwave-fusion.json" \
  --product-name "external-perimeter" \
  --engagement-name "Trustwave Fusion" \
  --auto-create-context

3. Reimport each cycle. Send each new scan to /api/v2/reimport-scan/ against the same Test, using the same scan type each time, so closed vulnerabilities are mitigated and history stays in one place.

Option: Trustwave Fusion connector (DefectDojo Pro). Instead of saving Fusion API JSON yourself, configure the connector in the DefectDojo Pro UI with a Trustwave Fusion API token for the tenant whose findings you want. Enter your Trustwave Fusion API URL in Location, the token in API Token, and optionally a Minimum Severity. The connector covers Fusion data only; CSV scan exports still go through the Trustwave Scan (CSV) import.

Data Granularity: What Gets Imported

Columns Status, Target Name, and Service are not mapped by the CSV parser.

Connector findings (DefectDojo Pro). The Trustwave Fusion connector derives Records from the findings themselves: each asset referenced by your findings becomes a Record, and findings are grouped by the asset they were reported against.

Use Cases

For managed external scanning: A company relies on Trustwave for quarterly perimeter scans. Each export is reimported into a Test for the perimeter Asset, so the infrastructure team works from DefectDojo and the security team can see what each quarter closed.

For automated pulls from Fusion: A team scripts a scheduled call to the Fusion API, saves the JSON, and reimports it with the Fusion scan type. On DefectDojo Pro, the Trustwave Fusion connector replaces that script with a scheduled sync. Either way, findings stay current without anyone downloading reports by hand.

During compliance reviews: When scans support a compliance requirement, DefectDojo keeps discovery date, owner, SLA status, and closure date for every Trustwave Finding, which answers the follow-up questions auditors ask after a scan report.

Combining provider and internal results: Trustwave Findings sit next to internal network and application scanner results on the same Assets, so leaders get one view of exposure rather than one per source.

Operational Tips

• Watch for collapsed rows in CSV imports. The CSV parser merges rows with the same severity, title, and description and increments the occurrence count, but only the first row's host is kept as the endpoint. If the same vulnerability appears on many hosts, check the original CSV or prefer the Fusion JSON, which keeps every location.
• Pick one format per Asset. CSV and Fusion Findings use different description sources and will not deduplicate against each other.
• CSV rows with a severity letter outside I, L, M, H, and C are imported as Low. Review those after the first import so SLA clocks start from the right severity.
• Fusion Findings carry Trustwave's unique ID, but both scan types fall back to the legacy deduplication algorithm. Reimporting into the same Test is the dependable way to keep one Finding per issue over time.
• Don't run the Fusion connector and Fusion JSON imports for the same tenant into the same Assets, or the same issues will be tracked twice.
• Tag imports with the scan cycle (for example tags=trustwave,2026-q4) to separate provider results from internal scanning in metrics.
• Use minimum_severity=Low if informational service discovery results, which Fusion reports as Info, add little for your team.