Wazuh Integration with DefectDojo
Wazuh is a free and open-source security platform that unifies Extended Detection and Response (XDR) and Security Information and Event Management (SIEM) capabilities to provide comprehensive threat detection, incident response, vulnerability management, and compliance monitoring across endpoints, cloud workloads, containers, and network devices. The platform deploys lightweight agents to collect security telemetry including log data, file integrity changes, and system configurations, while correlating events with MITRE ATT&CK framework mappings and threat intelligence feeds to detect malware, intrusions, misconfigurations, and policy violations with automated active response capabilities and compliance reporting aligned with PCI-DSS, HIPAA, GDPR, and SOC 2 standards throughout the security operations lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from Wazuh results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Wazuh",
"engagement": "<engagement-id>",
"file": "results.json"
}