Zimperium zScan Integration with DefectDojo

Zimperium zScan Integration with DefectDojo

Zimperium zScan is a mobile application security testing product from Zimperium. Teams upload Android or iOS app builds to zScan, which assesses each build and reports security and privacy issues found in the build, such as weak cryptography and hard-coded secrets. Assessment results are available as SARIF reports and through the zScan API. DefectDojo imports a zScan SARIF report, optionally wrapped with app and build context, and DefectDojo Pro can sync assessments through an API connector.

Zimperium zScan Integration with DefectDojo

Our mobile teams ship Android and iOS builds every sprint, and zScan assesses each one. What we needed was a way to see those results next to the backend findings for the same product and to tell whether an issue survived from one release to the next. Importing zScan assessments into DefectDojo gives each finding the app name, build version, and platform, so two builds of the same app stay distinct and we can follow a problem across releases.

Why Zimperium zScan Matters

Mobile apps run on devices you do not control, so problems in the build itself are what an attacker gets to examine.

• zScan assesses the compiled app build that is actually shipped, not only the source tree.
• It covers both Android and iOS from one place.
• Results use SARIF, a standard format with rules, locations, and severity properties.
• Each assessment is tied to a specific build, which is how release-to-release comparisons work.

Advantages of This Integration

What DefectDojo adds to zScan results:

• App and build context on every finding. A SARIF document does not say which app or build it came from. DefectDojo fills component name with the app name, component version with the build's version, the date with the build upload date, and adds the platform as a tag.
• Only failures imported. SARIF results whose kind is anything other than fail (for example pass) are skipped. A missing kind counts as a failure.
• Suppressions respected. A suppressed SARIF result imports as inactive and a false positive.
• Sensible severity. The rule's security-severity property is used first, as a CVSS number and then as a word, before falling back to the result level. A result with no level is Medium rather than Info.
• Per-build identity. Findings are identified by assessment, rule, file, and line, so the same rule firing in two builds stays two findings and you can see what carried over.
• File and connector agree. The parser mirrors the DefectDojo Pro connector, including its shared SARIF mapping, and uses the same scan type.

How This Integration Works

DefectDojo supports zScan with the Zimperium zScan scan type, by file (UI Import, API Import, Universal Importer in DefectDojo Pro) or through the DefectDojo Pro API connector.

1. Prepare the SARIF report. A bare zScan SARIF report imports fine, but it carries no app name, version, or platform. To supply them, wrap the report in a JSON object with an assessment block (id, appVersion, buildUploadedAt), an app block (name, platform), and the SARIF log under sarif (or log or report). The same fields may also sit at the top level. Include the assessment ID: without it, file findings will not deduplicate against connector-synced ones.

2. Import the file. In the UI, open an Engagement, choose Import Scan Results, select Zimperium zScan, and upload the JSON. Through the API, in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" 
  -H "Authorization: Token $DD_API_TOKEN" 
  -F "scan_type=Zimperium zScan" 
  -F "file=@zscan-assessment.json" 
  -F "product_name=mobile-banking-app" 
  -F "engagement_name=Release 3.2" 
  -F "auto_create_context=true"

With Universal Importer in DefectDojo Pro:

universal-importer import 
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" 
  --scan-type "Zimperium zScan" 
  --report-path "./zscan-assessment.json" 
  --product-name "mobile-banking-app" 
  --engagement-name "Release 3.2" 
  --auto-create-context

3. Or use the connector (DefectDojo Pro). Issue a zScan client ID and secret in zConsole under Account Management, Authorizations. In the DefectDojo Pro UI, add the Zimperium connector, enter your zConsole host in Location, the client ID and client secret in their fields, and optionally a Minimum Severity. DefectDojo exchanges the credentials for a bearer token on each sync. Each zScan mobile app becomes a Record carrying the findings of that app's latest completed assessment.

Data Granularity: What Gets Imported

Use Cases

Release-by-release tracking: Each app build is assessed in zScan and imported into an Engagement for that release. Because identity includes the assessment, the team can see which findings persisted from the previous build and which are new.

Mobile and backend in one Asset: The mobile app and its API share an Asset in DefectDojo, so a weak-crypto finding in the app and a related API finding are reviewed together.

Platform-specific triage: The platform tag lets Android and iOS teams filter to their own findings while sharing one Asset and one set of SLAs.

Restricted environments: Teams that cannot grant zScan API credentials export assessment SARIF, add the context wrapper, and upload it. Findings line up with the connector if it is enabled later.

Operational Tips

• Always include the assessment ID in file imports. It is part of every finding's identity and is what lets file and connector findings deduplicate.
• Add appVersion and platform to the wrapper. Without them, two builds of one app are hard to tell apart in DefectDojo.
• Suppress accepted results in zScan where possible. They import as false positives and stay out of active metrics.
• Expect Medium for results with no level. Review rule severity properties if Medium findings look inflated.
• Use one Engagement per release so per-build findings stay grouped and reports by release are straightforward.
• If you use both the file route and the connector, send both to the same Asset so their findings deduplicate.