Vulners Integration with DefectDojo

Vulners Integration with DefectDojo

Vulners is a vulnerability intelligence service at vulners.com that aggregates security bulletins, advisories, and CVE data from operating system vendors and other sources into one searchable database with an API. On top of that database, Vulners offers a Linux audit capability: the open source Vulners agent collects a host's operating system, version, and installed packages and sends them to the Vulners API, which returns the vulnerabilities that apply. Results appear in the Audit section of the Vulners account, and that audit report is what DefectDojo reads.

Vulners Integration with DefectDojo

We used the Vulners integration to get Linux host package vulnerabilities into DefectDojo without exporting files. DefectDojo called the Vulners API with our key, pulled the audit report, and turned each vulnerable package bulletin on each host into a Finding on the right Asset, with a fix command attached. Before relying on it for anything new, though, know its status: the Vulners parser is an API pull parser, and DefectDojo has deprecated it as of 3.2.0 with removal scheduled for 3.5.0 (November 2026).

Why Vulners Matters

Host package vulnerabilities make up a large share of infrastructure findings, and they are tedious to track by hand across a fleet.

• The Vulners agent is light. It gathers package and OS data and leaves the matching to the Vulners API.
• Findings reference vendor bulletins such as Red Hat or CentOS advisories, which map directly to the update a sysadmin needs to install.
• Each result includes a cumulative fix command for the affected host, which shortens the path from finding to patch.
• Without a tracker, audit results show the current state of a host but say nothing about how long a vulnerable package has been there or who is responsible for it.

Advantages of This Integration

What running Vulners results through DefectDojo provided:

• No file handling. The API pull fetched the audit report directly, so there was no export step to automate.
• Per-host findings. Each Finding carries the agent's IP address as its endpoint and the host's FQDN (or IP) as its component, so a bulletin on 40 hosts shows where it applies.
• Fix guidance on every Finding. The Vulners cumulative fix command lands in the Mitigation field.
• Severity and CVSS. Vulners severities map onto DefectDojo's scale, and CVSS v3 vectors are carried over when Vulners provides them, so SLAs apply as they would to any scanner.
• Platform workflow. Once imported, findings can be assigned, risk-accepted, pushed to Jira, and reported on with the rest of the Asset's results.

How This Integration Works

DefectDojo imports Vulners results with the Vulners scan type. It is an API pull parser: instead of reading an uploaded report, it uses a Tool Configuration and an API Scan Configuration on the Asset to call Vulners.

Deprecation first. The Vulners pull parser and the Tool Configuration setup it depends on are deprecated as of DefectDojo 3.2.0 and will be removed in 3.5.0 (November 2026). Unlike some other deprecated pull parsers, Vulners has no file-based parser and no Vulners connector, so there is currently no drop-in replacement. Teams that depend on it can request a connector from the DefectDojo Pro Cloud UI before 3.5.0.

1. Set up the agent and API key. Install the Vulners agent on your Linux hosts so their audit results reach your Vulners account, and generate a Vulners API key.

2. Configure DefectDojo (until 3.5.0). In Tool Configuration, add a configuration with Tool Type "Vulners" and the API key. Then, in the Asset's settings, choose Add API Scan Configuration and select that Tool Configuration.

3. Import. From the Asset or Engagement, choose Import Scan Results, select Vulners as the scan type, and import. No file is required. DefectDojo requests up to 10,000 audit report entries and then fetches bulletin details (description, references, CVE list, CVSS v3) for the vulnerabilities returned.

The parser can also read a saved Vulners audit report in JSON, shaped like the API response with data.report and data.vulns. While the scan type still exists, such a file can be submitted through the import API or, in DefectDojo Pro, Universal Importer:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Vulners" \
  -F "file=@vulners-audit.json" \
  -F "product_name=linux-fleet" \
  -F "engagement_name=Host Audit" \
  -F "auto_create_context=true"

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Vulners" \
  --report-path "./vulners-audit.json" \
  --product-name "linux-fleet" \
  --engagement-name "Host Audit" \
  --auto-create-context

Both paths go away when the Vulners scan type is removed in 3.5.0.

Data Granularity: What Gets Imported

Use Cases

For existing Vulners users before 3.5.0: A team already pulling Vulners audits into DefectDojo can keep doing so until the removal release, while deciding whether to request a connector or switch host scanning to a tool with a file parser or a DefectDojo Pro connector.

For patch tracking on Linux fleets: Each bulletin Finding names the host and the update command, so a sysadmin team can work a queue of hosts, apply updates, and see the Findings close on the next pull.

For audit evidence: Host vulnerability findings in DefectDojo keep their discovery date, owner, and closure date, which is easier to hand to an auditor than a series of point-in-time Vulners screens.

When migrating away: Exporting the current set of open Vulners Findings from DefectDojo before 3.5.0 gives a baseline to compare against whatever replaces the integration.

Operational Tips

• Treat this as a sunset integration. Put the 3.5.0 removal date on your calendar and decide on a replacement before then; if you need Vulners specifically, request a connector from the DefectDojo Pro Cloud UI early.
• Vulnerability IDs carry a VNS/ prefix, so a search for a plain CVE ID will not match them. Search on the prefixed form or on the title.
• Deduplication for the Vulners scan type falls back to DefectDojo's legacy algorithm, because the settings entries use the name "Vulners Scan". Reimport into the same Test rather than relying on cross-Test deduplication.
• The pull requests at most 10,000 report entries. On a large fleet, compare the imported count with the Vulners Audit view so a truncated pull does not go unnoticed.
• Use minimum_severity if Info-level bulletins add little for your team.
• If several API Scan Configurations exist on one Asset, select the right one on the Test, or the import fails with an error asking you to choose.