WhiteHat Sentinel Integration with DefectDojo

WhiteHat Sentinel Integration with DefectDojo

WhiteHat Sentinel is a dynamic application security testing (DAST) service for websites and web applications, originally developed by WhiteHat Security. It combines automated scanning with verification by WhiteHat's security engineers and reports vulnerabilities per site, each with the attack vectors that demonstrate it. WhiteHat Security was acquired by Synopsys from NTT in 2022, and Synopsys's Software Integrity Group became Black Duck in 2024. Sentinel exposes findings through its API, and DefectDojo imports the JSON returned by the site vulnerability query.

WhiteHat Sentinel Integration with DefectDojo

We use WhiteHat Sentinel for continuous DAST on our customer-facing sites, and DefectDojo is where those results meet the rest of our application security data. Sentinel tells us what is wrong with a site and how it was demonstrated. DefectDojo is where we assign the fix, track it against an SLA, and see it next to the SAST and SCA results for the same application. Because the import carries Sentinel's own status, closed and invalid vulnerabilities arrive already marked as mitigated or false positive, so the team does not triage the same decision twice.

Why WhiteHat Sentinel Matters

Dynamic testing finds problems that only exist in a running application: authentication and session flaws, injection points reachable through real requests, and information leaks in responses.

• Sentinel tests sites continuously rather than once per release, so new exposure shows up between pentests.
• Findings are reviewed by WhiteHat's engineers, which keeps false positives down compared with an unattended scanner.
• Each vulnerability lists the attack vectors, with the request URL that demonstrates the issue, which makes reproduction straightforward.
• Sentinel tracks status per vulnerability, but it does not know who in your organization owns the fix or how it compares with findings from other tools.

Advantages of This Integration

What we gained by sending Sentinel results through DefectDojo:

• Status carried over. Vulnerabilities with status "open" import as active. Those marked "invalid" become false positives, and other statuses import as mitigated, with Sentinel's closed date as the mitigation date.
• Every attack vector as an endpoint. Each attack vector's request URL becomes an endpoint on the Finding, so one vulnerability class on a site lists every affected URL.
• Custom risk respected. If you have set a custom risk in Sentinel, DefectDojo uses it in place of WhiteHat's default rating.
• CWE classification. When attack vector scanner tags include a CWE, it is set on the Finding, which helps with reporting by weakness class.
• Platform workflow. Findings can be assigned, held to SLAs, pushed to Jira, and reported with every other tool's results for the same Asset.

How This Integration Works

DefectDojo imports Sentinel data with the WhiteHat Sentinel scan type. The parser expects the JSON returned by Sentinel's site vulnerability query (api/vuln with query_site), with vulnerabilities in a top-level collection array.

1. Get the JSON. Query the Sentinel API for the site's vulnerabilities in JSON. The parser was built for a request that includes these options, which add the attack vectors, risk values, and descriptions it reads:

query_site=SITE_ID&format=json&display_attack_vectors=all&display_custom_risk=1&display_risk=1&display_description=custom

Save the response to a file. An empty collection is rejected by the parser, so skip the import when a site has no vulnerabilities.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select WhiteHat Sentinel, and upload the file. For automation, use the import API, available in Community Edition and DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=WhiteHat Sentinel" \
  -F "file=@sentinel-site.json" \
  -F "product_name=customer-portal" \
  -F "engagement_name=Sentinel DAST" \
  -F "auto_create_context=true"

DefectDojo Pro users can use Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "WhiteHat Sentinel" \
  --report-path "./sentinel-site.json" \
  --product-name "customer-portal" \
  --engagement-name "Sentinel DAST" \
  --auto-create-context

3. Reimport per site. Reimport each new pull for a site into the same Test so DefectDojo tracks changes over time in one place.

Data Granularity: What Gets Imported

Use Cases

For continuous DAST programs: A scheduled job pulls each Sentinel site's vulnerabilities and reimports into a Test per site. Developers see open Findings with attack vector URLs in DefectDojo, and closures in Sentinel show up as mitigated on the next import.

For application risk reporting: With Sentinel results on the same Asset as SAST and SCA Findings, an AppSec lead can report on a web application's full exposure, not only what dynamic testing sees.

For audits and customer questionnaires: Discovery dates, SLA status, and mitigation dates from Sentinel are kept per Finding, which supports evidence requests about how fast web vulnerabilities are closed.

During a tooling transition: Teams moving between DAST services can keep Sentinel history in DefectDojo and compare it with results from the new tool on the same Assets.

Operational Tips

• Include closed vulnerabilities in the pull if you want history. They import as mitigated with their closed date, which gives DefectDojo an accurate record of past fixes.
• Set custom risk in Sentinel where WhiteHat's default rating does not fit your context. DefectDojo uses it, so SLA clocks follow your decision.
• Map one Sentinel site to one Asset, or to one Test within an Asset, so endpoints and metrics stay attributable.
• Every imported Finding is marked verified. If your process treats verification as an internal step, account for that in dashboards and filters.
• The parser sets Sentinel's vulnerability ID as the unique ID from the tool, but this scan type falls back to the legacy deduplication algorithm. Self-hosted administrators can set DD_DEDUPLICATION_ALGORITHM_PER_PARSER to use unique_id_from_tool for "WhiteHat Sentinel" if they prefer ID-based matching.
• Push High and Critical Findings to Jira from DefectDojo so developers get the attack vector URLs in their backlog.