Twistlock Integration with DefectDojo

Twistlock Integration with DefectDojo

Twistlock is a container and cloud-native security platform that Palo Alto Networks acquired in 2019 and now sells as Prisma Cloud Compute, part of Prisma Cloud. It scans container images, hosts, and serverless functions for vulnerable packages and compliance issues, and protects running workloads. Image scan results can be exported as CSV from the Console, or produced in JSON by twistcli, the command line tool that scans images in CI pipelines. DefectDojo imports both formats under one scan type.

Twistlock Integration with DefectDojo

We use Twistlock (Prisma Cloud Compute) to scan images in CI and in our registries, and DefectDojo is where the resulting CVEs are assigned and tracked. Twistlock is good at telling us what is in an image. It is less suited to answering who owns a CVE across twenty services, whether it is past its SLA, or whether it was already risk-accepted last quarter. Importing Twistlock results into DefectDojo puts each vulnerable package on the Asset that owns the image, deduplicated against earlier scans and tied into the same workflow as our code and dependency findings.

Why Twistlock Matters

Container images ship an operating system's worth of packages plus application dependencies, and most of their CVEs come from layers application teams did not write.

• twistcli scans images before they are pushed, so vulnerable builds can be caught in the pipeline.
• Scan results identify the package, the installed version, the CVE, a CVSS score, and the fix status, which is what an engineer needs to decide whether a rebuild will help.
• The Console's CSV export includes registry, repository, tag, host, and cluster context for each vulnerability.
• Without a central tracker, image CVEs are reviewed one scan at a time and lose their history between rebuilds.

Advantages of This Integration

What we gained by sending Twistlock results through DefectDojo:

• Deduplication on package identity. DefectDojo hashes Twistlock Findings on title, severity, component name, and component version, so rescanning the same image does not create new copies of each CVE.
• Context without breaking dedupe. Registry, repository, tag, image ID, distribution, hosts, and clusters are stored in the Impact field rather than the description, so a new tag does not change a Finding's identity.
• Severity normalization. Twistlock's "important" and "moderate" ratings map to High and Medium, so container CVEs fall under the same SLA rules as other scanners.
• Compliance checks from twistcli JSON. Compliance issues in JSON reports become Findings tagged compliance, separate from CVE Findings.
• Reimport lifecycle. Reimporting after a base image update mitigates CVEs that disappeared and reactivates any that come back.

How This Integration Works

DefectDojo imports Twistlock results with the Twistlock Image Scan scan type. The parser chooses the format by file extension: files ending in .csv are read as Console CSV exports, and files ending in .json as twistcli output.

1. Produce a report. For CSV, export the image vulnerability report from the Prisma Cloud Compute Console. For JSON, scan with twistcli:

twistcli images scan registry.example.com/payments-api:2.3.1 \
  --address https://YOUR_CONSOLE_URL \
  --user ci-scanner \
  --details \
  --output-file=twistlock-report.json

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select Twistlock Image Scan, and upload the file. For automation, use the import API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Twistlock Image Scan" \
  -F "file=@twistlock-images.csv" \
  -F "product_name=payments-api" \
  -F "engagement_name=Container Builds" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Twistlock Image Scan" \
  --report-path "./twistlock-images.csv" \
  --product-name "payments-api" \
  --engagement-name "Container Builds" \
  --auto-create-context

3. Reimport per image. For an image you scan on every build, reimport into the same Test through /api/v2/reimport-scan/ so fixed CVEs are closed and history stays together.

Data Granularity: What Gets Imported

Use Cases

In a CI/CD pipeline: Each build runs twistcli and reimports the JSON into a Test named for the image. Engineers see what changed since the previous build, and a release gate can query DefectDojo for new Critical Findings.

For registry-wide reporting: A platform team exports the Console's image vulnerability CSV on a schedule and imports it per Asset. Leads see container exposure by team, with registry and tag details in each Finding's Impact field.

When patching base images: After updating a shared base image, reimporting each service's scan shows which CVEs the update closed across services and which remain in application-installed packages.

For audits: Container CVEs keep their discovery date, SLA status, and remediation history in DefectDojo, so evidence does not depend on Console screenshots.

Operational Tips

• Keep the file extension. The parser picks CSV or JSON by the file name ending, and any other extension is rejected as an unknown format.
• Scan one image per JSON file. The JSON parser reads only the first entry in the report's results array.
• Within one CSV, rows with the same severity, title, and description are collapsed into a single Finding, so one CVE in one package on several images appears once per import. Split exports per image or repository if you need per-image Findings.
• Because the hash does not include the image tag, the same CVE in the same package version is treated as a duplicate across tags. Use separate Tests or Engagements per image when that distinction matters.
• Filter or exclude the compliance tag if you want CVE metrics without configuration checks mixed in.
• Risk-accept CVEs that have no fix yet with an expiration date, so they come back for review when the vendor publishes one.