00:00 Welcome and Setup
00:50 What Parsers Do
01:36 Findings and Reimport
04:36 DefectDojo Data Model
06:53 Five Ingestion Methods
10:38 Unsupported Tools Options
13:42 Universal Parser Walkthrough
16:43 Deduplication Tuning
20:52 Community vs Pro Breakdown
23:41 Key Takeaways and Q&A
All right. Thank you, Chris. Yes, we are gonna talk parsers, and it's funny, Chris and I debated. I never liked this title, to be really honest with you. Like, intro to parsers sounds extremely boring.
But we never could think of a better one, so that's what we're doing. It's really all about how you get data into DefectDojo and the different choices you have there. Um, that's a bit of a windy or long title, so, uh, we went with intro to parsers. That's good enough. So yes, I'm Matt Tesauro. I am the CTO and co-founder of DefectDojo Inc.
I've been doing OWASP since 2008, so quite some time. Bunch of different project leaders, including DefectDojo. I've done a bunch of training. Yeah, I've just been around this whole AppSec thing for, and DevSecOps thing, for quite some time. So what, what are we covering today? So there's four things.
We're gonna talk about what are parsers, not in the, like, computer science-y thing, but what are parsers in a DefectDojo world and how do they fit into the big picture of Dojo. We'll talk about other ways besides the traditional, like, upload a file thing that we have in DefectDojo land. Uh, we're gonna talk about if you have sort of custom data and you need to ingest it, how does that happen?
You know, if you happen to have some edge cases where things don't line up in the sort of normal path, there are options, and we'll cover those. And then we'll, uh... I'll talk about this all throughout, but then at the end we have sort of a chart that does the differences between community and what's in Pro big surprise to all the people here parsers turn scans into findings in DefectDojo.
And DefectDojo has a very loose definition of a finding. It doesn't care. If there's a thing that you want addressed, doesn't necessarily even have to be security related, although big shock, people tend to put security things in Dojo, you can put it into Dojo. Dojo has very few restrictions on a finding and what those look like.
So we, we purposefully made Dojo very flexible because I've worked at a bunch of different places and, and what people care about changes based on the company and their maturity and all those other things. So the idea with the parser in Dojo land is you have a scanner that produces some sort of report.
Regrettably, these are very snowflakey. Uh, we found incredibly fun things like, I forget who it was, but there's a vendor who produces CVSS vectors that don't equal the severity they assign to their findings. So you can have a CVSS vector that's, say, critical and a f- and their severity from the tool is medium.
And you're like, how do I reconcile this? So that's the kind of stuff that Dojo deals with so you don't have to, um, when you're importing data. And so then the parser then takes that file, breaks it into its pieces, maps it into the, the data model of DefectDojo's finding does some other things around like CVEs and other, uh, vulnerability identity, uh, identifiers, and then creates findings.
And then once those are, they're there, they get queued up, we can do the dedup. We, the DefectDojo, can do the dedup. And the biggest thing honestly is that you take this snowflakey... This is the fundamental problem we started with when we made Dojo years ago. We take the snowflakey N number of ways to identify a security issue and turn it into just a finding.
And once it's there, then you have a consistent way to deal with output from anything, which I think is the, the biggest thing. And then just a footnote in Dojo land, a scan type is what we call these parsers. So if you're using, I don't know, Semgrep, the scan type will be Semgrep. What that really means is under the covers Dojo will use the parser for Semgrep to read in your Semgrep JSON or what have you and turn it into Dojo findings And then another little footnote re-import is a, a, uh, you could call it a special kind of way to bring Dojo data into Dojo in that if you are scanning the same scope, this is like super critical double underline this portion, if you're scanning the same scope, then doing re-import is really what you want to do.
Because doing a re-import lets Dojo say, "This is what I found last time, this is what I found this time. Let me compare them and open and close things as makes sense," so you end up with one actionable list of findings. Very, very useful if you're doing the same testing scope over and over. Now, if you do something interesting like scan one repo and then re-import a different repo scan, you will not get the results you want because that's exactly what re-import was not made to do.
So go figure, it doesn't work well Um, and just a little, uh, step backwards to talk about the, how the data model works in DefectDojo. So lowest level or highest level, I guess depending on how you wanna think of it, is an organization. This is where you can group any number of assets together. These used to be called product types.
We've recently just changed the nomenclature, 'cause it seems to be more generic and people get it better. Asset is the next level down, so an organization can have one or more assets. Assets used to be called products. Um, and this is just a way to sort of name a system, a repo, a something. I like to think of it as a...
I like to make my assets be a scope of something that I'm gonna test. Um, although that, that's a bit loose, but that's generally how I like to think about it. An engagement represents some kind of testing activity. This allows you to combine multiple, usually scanner outputs, but you can also combine, say, a manual pen test and scanner output into one engagement.
It's just a way to collect multiple tests together. Sometimes this makes sense, sometimes you have an engagement with only one test. And a test, obviously, is the thing that you're importing, the thing we're talking about today, an output from a scanner, generally speaking. And then findings, which we've already talked about.
And then one other something is, and we did this years ago in DefectDojo, to allow you to write simpler code or more simple code for importing through the REST API and through some other things now. Uh, we have this idea of auto-create context, and the, the concept there is I'm going to tell you I wanna import this scan file into this particular org and this particular asset.
And DefectDojo will s- go and say, "Okay, let me look up. Oh, I don't see that org? Okay, I'll create it. Oh, I don't see that asset? Okay, I'll create it." And so it'll automatically create the hierarchy you need to get all the way down to, uh, engagement test finding, et cetera, so that you don't have to have these somewhat smart CICD jobs that go, "Hey Dojo, do you have this organization?
Oh, you do? Great. Oh, if not, create. Oh, do you have this asset?" Et cetera, et cetera. It just streamlines things. It's really actually a, one of those simple features that's a, a godsend in terms of productivity let's talk about how we get data in. There's sort of, let's call it five ways to do it. So the traditional way, you run a scan, you output a file, you go to DefectDojo, you log into the web UI, and you im- you upload it, right?
That's the UI import. That's the sort of standard, not very sexy, honestly, uh, way to do things, but it works, and it's been there forever in DefectDojo. Uh, the next thing that's also been there forever in DefectDojo is the REST API. So if I don't wanna have to log in to shove a scan result into DefectDojo, I can just make a REST call and push it in, and this is where that auto-create context comes into play for both the import and the re-import, uh, endpoints there for pro users, we have what we call the Universal Importer CLI.
And so it's a single binary that lets you configure it via configuration files, environmental variables, or command line options. Um, and then from there you can import whatever your CI/CD is producing into DefectDojo in whatever way you want. The idea being instead of making a GitHub Action and a GitLab Runner and a Jenkins whatever, we just made one binary that works in all the places, and whatever you have, it works.
So I can use it on my laptop directly, or I can drop it into a GitHub Action, a GitLab Runner, or whatever, and it just works. Connectors. So connectors are another pro feature that reaches out to vendors that have APIs that they produce that list the findings for whatever their tool is. Um, from there you can, on a daily basis, uh, reach out and pull in those results.
There's tons of these now. We have 80-plus connectors in DefectDojo so we probably have a connector for what you're looking for if it's-- if if you're interested in just setting it up once and letting DefectDojo pull on those findings. And it basically, in the internals of DefectDojo, it's doing a re-import of the equivalent to assets that vendor has.
Because, of course, there's not a standard way that vendors sort of lay out how they do scans, and so DefectDojo will translate however they organize things on the vendor side of the API into the hierarchy in DefectDojo. And then, uh, Pro also has a feature called Smart Upload that allows you to do infrastructure scans and match those to either endpoints or locations.
Locations is kind of the new thing. Um, and automatically put those results in the right place. So if you have a bunch of infrastructure already in DefectDojo, and you run a broad scan, like a Nessus scan of my everything, DefectDojo can chop that up into pieces and put it in the right place, basically.
And then there's been a minor change that I wanted to note to people who are pro users for connectors. We used to have this idea of connectors and integrators. So connectors would pull data in, and integrators would push data out. We sort of streamlined that and just made upstream and downstream connectors.
If you look on the side here, you can see that we have upstream connectors. You can configure them, you can request a new one, and then you can also configure a bunch of them here. And then there are also, uh, the downstream connectors, things like Jira, ServiceNow, um, GitHub issues, GitLab issues, those kind of places where you can push stuff out into DefectDojo.
We sort of just consolidated them into one instead of having two menu items
Oh, okay. So I've been talking a lot about different ways to get da- data in. What if you have an unsupported tool? You happen to have that 230th tool that we just don't happen to have a parser for or something like that. Or we've seen this a lot with some of our customers, you have a tool that you created internally, or you have an internal process.
Like, I had a, a financial that did what they called a security controls review, which was sort of a desk exercise of sorts, where they would bring the dev team in with the security AppSec person, and they would say, "These are the, the controls that we expect your app to have. Demonstrate to me that you have them."
And they would be, you know, "Yes, they do," or, "No, they don't." Those were produced a list of failures if they didn't have those control failures, and they wanted to store these in Dojo. And Dojo happily took those, 'cause that's a security issue that you wanna track, right? Which easily fits into the finding model.
So if you have any of these kind of corner cases where there's just not something we have, you have options. So the first option that's been around for quite some time at DefectDojo is what we call generic importers. So this allows you to take whatever data you have, turn it into a CSV or JSON, and then upload that into DefectDojo.
JSON in, in this case or the case of generic parsers is a better choice if you don't mind the little slightly more crunchy syntax of JSON versus a spreadsheet, because there's more options. Multi-value things are much easier to represent in JSON than they are in CSV. Go figure. Like a single row column with multiple values gets super clunky in CSV.
It doesn't in JSON. So you get more field support in JSON. So if you have a choice, if it's simple data, CSV is gravy. If it's more complex data and you wanna do more things with it, you get the full fi- the full finding model with JSON. You don't quite get the full finding model with CSV But so if you can convert whatever you want into JSON or CSV, you can bring it in.
You can also rename it after it's in so that you know where that source is from, so it doesn't just say generic importer. It can say whatever, like my custom company tool. Uh, universal parser is a pro feature that allows you to upload a file and then automatically create a parser out of it. I'll talk about that in a minute, or more about that in a minute.
And then, uh, deduplication tuning. Once you have findings coming in, DefectDojo allows you to tune how we do those matches for deduplication. And just to be completely forthcoming about universal parser, I kind of look at that as like your parachute. If you have to get something in and we don't have a parser for it and you're a pro customer, it's a really quick and easy way to make a parser.
You don't get access to the full finding model with the universal parser, so it's a, it is a good solution. I like to think of it as a temporary solution until we can get you a, an air quote real parser or figure out a way to get you in, your data in more holistically if the universal parser doesn't meet your needs
So how does that universal parser work? So you upload a sample that can be JSON, CSV, or XML and then you give it a name, right? This is the, I don't know, Matt's internal tool universal parser. Uh, and then you go to the next step, which will DefectDojo will list all of the finding fields and then all of the data fields it found in the, the file that you uploaded, that sample, and then you map them.
You say, this field goes to that, this field goes to this other thing. I want these both to go into description. Whatever you wanna do. It'll give you a preview of what the data will look like based on that sample. So this is what the finding table will basically look like for you, and if you're good with it, you submit.
And now you've got a parser that works like any other parser for DefectDojo. Pretty straightforward. Now, there's one caveat that really comes into play for universal parser, but actually it's true for any of the scan types you cannot remove scan types. And the reason we did this is a data integrity issue.
DefectDojo, if for some reason there was an existing finding data with that scan type, we'd end up orphaning it, right? It would be disconnected from the data hierarchy. So we don't allow you to delete. If you make a universal parser and realize like, "Oh, shoot, I don't want that into the description, I messed that up," you can make a new one that fixes whatever thing you noticed, or maybe the vendor adds a new field and you have to remap it.
Um, but you can't delete that old one. Instead, you can deactivate it. And when you deactivate it, what that does is it hides it from all the places. It just keeps it buried in the database and you don't see it anymore. And the reason we did that is, like we said, for data integrity. That if there are any findings that are mapped to that scan type, if you delete it, then suddenly you have this broken references basically inside of DefectDojo.
Um, you can also select if they're static or dynamic. And you can also do dedupe and re-import hash codes under pro settings in the, in the pro DefectDojo. There's... I'll explain how to do that in a minute for community. And then if you do have a scanner change, you can always rename them.
We've have some customers that have had, like they've revved their internal tool several times and they're using UP, the universal parser, to handle those new additions, and they just put a version on it. Internal tool V1, V2, V3. They deactivate those earlier versions once they're no longer importing using that, uh, internal tool, and they're off to the races.
So there's just some caveats. You can't-- A lot of customers are initially confused, like, "I messed this up. I don't like this universal parser, I wanna delete it." Well, well, you can't. But you can hide it and never see it again, which is functionally equivalent. There's a few bytes in a database somewhere, but you'll never see them, so it's really not that painful, and it makes sure that there's data integrity in your Dojo, which is probably u- worth a few bytes tuning deduplication.
So you've got your data in, you're using a parser or a connector or a generic importer or whatever you're using to get your data in, and now you're, you're wanting to tune or fine-tune the deduplication setting. So, uh, b- out of necessity, honestly, because this is an open source project, and we have no idea how you write code or how you do things security-wise at wherever you're working we use sort of, sort of the, the best, our best guess at what the sensible selection of fields are.
And I... Let me take a step back. When you cr- when we do deduplication in DefectDojo, we take a selection of fields that that scan type has and compare those across scan types. Sometimes we're lucky. Sometimes scanners are nice, and they have a unique ID for that vulnerability type that's reported by that scanner, um, and they provide it in their scan output.
So I know Qualys does this for better or worse. So Qualys has a vulnerability ID that they associate. So if you get a reflective cross-site scripting in your web application with Qualys web scanner thing, it will give it a unique ID. And so it's very easy for DefectDojo to dedup because if the same asset has that same vulnerability ID with the same sort of parameters around that cross-site scripting, it's super easy to match, super easy to match.
However, most tools don't do that. So you have to select a number of fields to say, if these all line up for the same asset, then it's a dupe. And so we've set those at what we think are the, the best sort of general case. However, you may use a framework that does some weird things that trips up scanners.
You may have like a monorepo that does some odd things to your SCA scanning. Whatever the case is, you can tune those if for some reason dedup isn't working for you. So, um, there are these of the list of fields that determine a duplicate, a duplicate. Wow, I can't speak this morning. Duplicate. You can select which ones they are beyond what we give you out of the box.
So if you decide that I don't like, I don't know, description, and I wanna use something else instead, CVE, CVSS score, I don't know, I'm picking something out of the blue, you can do that. You can make that change. Um, and then all future imports will use that. You can also run a manual job to catch you up if you're running, If you're running the community one, if you need to, to catch up to make sure dedupe is recalculated.
Um, because if you make a change of fields, then suddenly those old calculations no longer follow that same formula. Um, and then for Pro-- Well, for community, we have the ability to dedupe within a tool. So within an asset, like if I run I don't know, sneak against this particular asset, here's the fields I use to dedupe, and you can run those, and it'll dedupe automatically for you.
No problem. For Pro, we also introduced the same ability to configure across tools. So between two different tools, I have Veracode and Checkmark for reasons, and I wanna dedupe across those tools, two SaaS tools, I can do that. And then you can also tune re-import, because re-import uses the same sort of process.
A number of fields that come in for a scanner are compared, create a hash code, and the hash code is used to find if there are duplications. So for, um, open source or community it is editing the, uh, settings.py file. So in settings.py, you'll find, um... Yours will be named settings.py, not settings.dist.py. We do that so we don't override your file on updates.
But there'll be a long list in the dedupe of dedupe fields, two hundred some odd, because we have two hundred some odd scanners, and you can change those values. You do have to restart Dojo when you do this but it's easy to adjust those. A little bit of VI-ing or your favorite editor, and you're off to the races.
If you're a Pro customer, we have a UI for this that does, uh, functionally the same thing. You don't have to restart in, in the Pro case. But you can select the fields that make up that particular scanner, uh, dedupe hash code, and then set them and tune them and experiment with them and see how it works and fine-tune things so that it works better for you and then finally, what's the difference between all these different import methods across DefectDojo community and pro?
So parsers, everybody gets the same 250. I don't even know what the count is anymore. I haven't counted in a while. It was, uh, well over 200 the last time I counted back in, like, March, and we haven't slowed down adding them. So your 200 some odd parsers are available. Same with the generic import of CSV and JSON.
Those have been around for eons. And then if you're a, a pro customer, you also have the universal parser. If you're doing automation, uh, you have the full REST API, the re-import and import, and auto-create context stuff that I talked about earlier, both in community and in pro. And then you also get the universal importer if you're a pro customer.
Uh, integrations, you can do file-based ingestion for every of the supported tools. For pro, you have the connectors, those 80 some odd connectors that we talk to vendors that have APIs that allow us to pull in findings. It's scheduled, and you just set it once, and then it goes off and does its thing infrastructure, you have your standard infrastructure scans in, in community, and then in pro you've got the smart upload.
Uh, dedupe you can tune same scan. And then for pro you can do that also same scan tuning as well as cross tool and re-import. Uh, prioritization, you kind of control your destiny in community, right? The... You can pick whatever you want to prioritize with and, and do that prioritization. You can add metadata, you can use CV- CVSS.
Um, if a tool happens to add EPSS, you can use it for that, whatever you wanna do. There's asset grading as well that's been in DefectDojo for a long time. So there's several levers you have to do in the open source community version. And then on pro, uh, we automatically add EPSS and KEV for you to any findings.
So if the tool reports it or not, it'll be added. Um, we have a risk and prioritization engine in pro that does... uses metadata inside of the a- at the asset level and a couple other places in DefectDojo and produces a risk and priority score for you. And then there's also AI triage that we have recently added to DefectDojo Pro.
And then for enterprise, there's basic RBAC and community support. And then for pro there's SSO, a more granular RBAC and SLA backed support. Obviously you're paying us, you get commercial support. So key takeaways, there's tons of different ways to get d- data into Dojo. It's like a data vacuum in some regards.
So you have lots of choices. And fundamental to Dojo's initial creation, we never wanted to make you adopt how Dojo works. We wanted to flip that model and have Dojo adopt how you work, because no AppSec place I've ever worked at was the same. If you have an unsupported tool, you're not lost. Yeah, I mean, you're, you're welcome to create a parser.
We love when people do parser contributions, do a PR in open source. That's groovy. We love that. Um, but if not, and if you don't want to, you can always use those generic importers or the universal parser. Uh, dedupe scope is really important to think about. Think about what makes sense, and then tune it if you have these kind of edge cases where the the best guess we can make when we set up those parsers doesn't quite match your situation because you have a funny framework or something.
And then hierarchy. Uh, the hierarchy matches nicely with RBAC and gives the ability if you need to. Some places care about this, some places don't care about sort of, I don't want team A to see team B's findings, and others are much more open. So whatever your sort of corporate culture is, you can do that RBAC stuff, uh, in pro.
And then I'm at the questions page, and I think I've seen some stuff roll in.