Xanitizer Integration with DefectDojo
Xanitizer is a static application security testing (SAST) tool that identifies security vulnerabilities in web applications through static code analysis and data flow taint analysis, detecting over 80 vulnerability types including SQL injection, cross-site scripting, and privacy leaks in Java, JavaScript, and TypeScript code. The tool systematically scans source code, configuration files, and HTML rendering templates to help developers and security auditors detect and remediate security issues early in the software development lifecycle before applications are deployed to production.
Data Granularity: What Gets Imported
The following fields are captured from Xanitizer results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Xanitizer",
"engagement": "<engagement-id>",
"file": "results.json"
}