ZAP Integration with DefectDojo
ZAP (Zed Attack Proxy) is an open-source dynamic application security testing (DAST) tool that identifies security vulnerabilities in web applications during runtime by acting as an intercepting proxy between browsers and web applications, detecting issues such as SQL injection, cross-site scripting, insecure authentication, and security misconfigurations. The tool performs both passive scanning to analyze HTTP requests and responses without modification, and active scanning that simulates real attacks using known attack vectors to discover vulnerabilities that could be exploited by malicious actors before applications are deployed to production environments.
Data Granularity: What Gets Imported
The following fields are captured from ZAP results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "ZAP",
"engagement": "<engagement-id>",
"file": "results.json"
}