What it does. Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD, Jira ticketing, and Slack notifications via its REST API. Use when consolidating scanner output into one dashboard or automating vulnerability ticketing and executive reporting. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/building-vulnerability-dashboard-with-defectdojo/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-vulnerability-dashboard-with-defectdojo, or copy the skill folder into ~/.claude/skills/building-vulnerability-dashboard-with-defectdojo/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-vulnerability-dashboard-with-defectdojo/SKILL.md

SKILL.md (verbatim)

1 placeholder credential was shortened (for example to api_key=YOUR_KEY) to pass the site's secret filter.

name: building-vulnerability-dashboard-with-defectdojo
description: Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD, Jira ticketing, and Slack notifications via its REST API. Use when consolidating scanner output into one dashboard or automating vulnerability ticketing and executive reporting.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- defectdojo
- vulnerability-management
- dashboard
- deduplication
- scanner-integration
- devsecops
- jira
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068

Building Vulnerability Dashboard with DefectDojo

Overview

DefectDojo is an open-source application vulnerability management platform that aggregates findings from 200+ security tools, deduplicates results, tracks remediation progress, and provides executive dashboards. It serves as a central hub for vulnerability management, integrating with CI/CD pipelines, Jira for ticketing, and Slack for notifications. DefectDojo supports OWASP-based categorization and provides REST API for automation.

When to Use

• When deploying or configuring building vulnerability dashboard with defectdojo capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Docker and Docker Compose
• 4GB+ RAM, 2+ CPU cores, 20GB+ disk
• PostgreSQL 12+ (included in Docker deployment)
• Python 3.9+ for API integration scripts
• Jira instance (optional, for ticket integration)

Deployment

Docker Compose Deployment

# Clone DefectDojo repository
git clone https://github.com/DefectDojo/django-DefectDojo.git
cd django-DefectDojo

# Start with Docker Compose (production mode)
./dc-up-d.sh

# Alternative: manual Docker Compose
docker compose up -d

# Check service status
docker compose ps

# View initial admin credentials
docker compose logs initializer 2>&1 | grep "Admin password"

# Access DefectDojo at http://localhost:8080

Environment Configuration

# Key environment variables in docker-compose.yml
DD_DATABASE_ENGINE=django.db.backends.postgresql
DD_DATABASE_HOST=postgres
DD_DATABASE_PORT=5432
DD_DATABASE_NAME=defectdojo
DD_DATABASE_USER=defectdojo
DD_DATABASE_PASSWORD=<secure_password>
DD_ALLOWED_HOSTS=*
DD_SECRET_KEY=<random_64_char_key>
DD_CREDENTIAL_AES_256_KEY=<random_128_bit_key>
DD_SOCIAL_AUTH_GOOGLE_OAUTH2_ENABLED=True

Organizational Structure

Hierarchy

Product Type (Business Unit)
  └── Product (Application/Service)
       └── Engagement (Assessment/Sprint)
            └── Test (Scanner Run)
                 └── Finding (Individual Vulnerability)

Setup via API

import requests

DD_URL = "http://localhost:8080/api/v2"
API_KEY = YOUR_KEY
HEADERS = {"Authorization": f"Token {API_KEY}", "Content-Type": "application/json"}

# Create Product Type
resp = requests.post(f"{DD_URL}/product_types/", headers=HEADERS, json={
    "name": "Web Applications",
    "description": "Customer-facing web application portfolio"
})
product_type_id = resp.json()["id"]

# Create Product
resp = requests.post(f"{DD_URL}/products/", headers=HEADERS, json={
    "name": "Customer Portal",
    "description": "Main customer-facing web application",
    "prod_type": product_type_id,
    "sla_configuration": 1,
})
product_id = resp.json()["id"]

# Create Engagement
resp = requests.post(f"{DD_URL}/engagements/", headers=HEADERS, json={
    "name": "Q1 2024 Security Assessment",
    "product": product_id,
    "target_start": "2024-01-01",
    "target_end": "2024-03-31",
    "engagement_type": "CI/CD",
    "status": "In Progress",
})
engagement_id = resp.json()["id"]

Scanner Integration

Import Scan Results via API

# Upload Nessus scan results
curl -X POST "${DD_URL}/reimport-scan/" \
  -H "Authorization: Token ${API_KEY}" \
  -F "scan_type=Nessus Scan" \
  -F "file=@nessus_report.csv" \
  -F "product_name=Customer Portal" \
  -F "engagement_name=Q1 2024 Security Assessment" \
  -F "auto_create_context=true" \
  -F "deduplication_on_engagement=true"

# Upload OWASP ZAP results
curl -X POST "${DD_URL}/reimport-scan/" \
  -H "Authorization: Token ${API_KEY}" \
  -F "scan_type=ZAP Scan" \
  -F "file=@zap_report.xml" \
  -F "product_name=Customer Portal" \
  -F "engagement_name=Q1 2024 Security Assessment" \
  -F "auto_create_context=true"

# Upload Trivy container scan
curl -X POST "${DD_URL}/reimport-scan/" \
  -H "Authorization: Token ${API_KEY}" \
  -F "scan_type=Trivy Scan" \
  -F "file=@trivy_results.json" \
  -F "product_name=Customer Portal" \
  -F "engagement_name=Q1 2024 Security Assessment" \
  -F "auto_create_context=true"

Supported Scanner Types (Partial List)

Scanner	Type String	Format
Nessus	Nessus Scan	CSV/XML
OpenVAS	OpenVAS CSV	CSV
Qualys	Qualys Scan	XML
OWASP ZAP	ZAP Scan	XML/JSON
Burp Suite	Burp XML	XML
Trivy	Trivy Scan	JSON
Semgrep	Semgrep JSON Report	JSON
Snyk	Snyk Scan	JSON
SonarQube	SonarQube Scan	JSON
Checkov	Checkov Scan	JSON

CI/CD Integration (GitHub Actions)

# .github/workflows/security-scan.yml
name: Security Scan
on: [push]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Semgrep
        run: |
          pip install semgrep
          semgrep --config auto --json -o semgrep_results.json .
      - name: Upload to DefectDojo
        run: |
          curl -X POST "${{ secrets.DD_URL }}/api/v2/reimport-scan/" \
            -H "Authorization: Token ${{ secrets.DD_API_KEY }}" \
            -F "scan_type=Semgrep JSON Report" \
            -F "file=@semgrep_results.json" \
            -F "product_name=${{ github.event.repository.name }}" \
            -F "engagement_name=CI/CD" \
            -F "auto_create_context=true"

Jira Integration

# Configure Jira integration in DefectDojo settings
jira_config = {
    "url": "https://company.atlassian.net",
    "username": "jira-bot@company.com",
    "password": "jira_api_token",
    "default_issue_type": "Bug",
    "critical_mapping_severity": "Blocker",
    "high_mapping_severity": "Critical",
    "medium_mapping_severity": "Major",
    "low_mapping_severity": "Minor",
    "finding_text": "**Vulnerability**: {{ finding.title }}\n**Severity**: {{ finding.severity }}\n**CVE**: {{ finding.cve }}\n**Description**: {{ finding.description }}",
    "accepted_mapping_resolution": "Done",
    "close_status_key": 6,
}

Metrics and Dashboards

Key Metrics API Queries

# Get finding counts by severity
resp = requests.get(f"{DD_URL}/findings/?limit=0&active=true",
                    headers=HEADERS)
findings = resp.json()

# Get SLA breach counts
resp = requests.get(f"{DD_URL}/findings/?limit=0&active=true&sla_breached=true",
                    headers=HEADERS)

# Get product-level metrics
resp = requests.get(f"{DD_URL}/products/{product_id}/",
                    headers=HEADERS)
product_data = resp.json()

References

• DefectDojo GitHub
• DefectDojo Documentation
• DefectDojo REST API
• OWASP DefectDojo Project
• DefectDojo Integrations

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

DefectDojo Configuration Template

Product Hierarchy Setup

Product Types (Business Units)

Product Type	Description
Web Applications	Customer-facing web applications
Mobile Applications	iOS and Android apps
Internal Tools	Employee-facing internal applications
Infrastructure	Network and cloud infrastructure
APIs	REST and GraphQL API services

Scanner Type Mappings

Scanner	DefectDojo Scan Type	File Format
Nessus	Nessus Scan	.csv or .nessus
OWASP ZAP	ZAP Scan	.xml or .json
Burp Suite	Burp XML	.xml
Trivy	Trivy Scan	.json
Semgrep	Semgrep JSON Report	.json
Snyk	Snyk Scan	.json
SonarQube	SonarQube Scan	.json
Checkov	Checkov Scan	.json
Bandit	Bandit Scan	.json
OpenVAS	OpenVAS CSV	.csv
Qualys	Qualys Scan	.xml

SLA Configuration

Severity	Days to Remediate
Critical	7
High	30
Medium	90
Low	120
Info	No SLA

Jira Integration Settings

Jira URL: https://company.atlassian.net
Project Key: SEC
Issue Type: Bug
Priority Mapping:
  Critical -> Blocker
  High -> Critical
  Medium -> Major
  Low -> Minor
Auto-close: Yes (when finding is closed in DefectDojo)

CI/CD Integration Snippet

# Generic CI/CD step for DefectDojo upload
- name: Upload scan results to DefectDojo
  env:
    DD_URL: ${{ secrets.DEFECTDOJO_URL }}
    DD_API_KEY: ${{ secrets.DEFECTDOJO_API_KEY }}
  run: |
    curl -X POST "${DD_URL}/api/v2/reimport-scan/" \
      -H "Authorization: Token ${DD_API_KEY}" \
      -F "scan_type=${SCAN_TYPE}" \
      -F "file=@${SCAN_FILE}" \
      -F "product_name=${PRODUCT_NAME}" \
      -F "auto_create_context=true" \
      -F "close_old_findings=true"

references/api-reference.md (verbatim)

API Reference: Vulnerability Dashboard with DefectDojo

Authentication

# Token-based auth
curl -H "Authorization: Token $DEFECTDOJO_TOKEN" \
  "http://localhost:8080/api/v2/findings/"

Core Endpoints

Method	Endpoint	Description
GET	/api/v2/findings/	List vulnerability findings
GET	/api/v2/products/	List products
GET	/api/v2/engagements/	List engagements
GET	/api/v2/tests/	List tests
POST	/api/v2/import-scan/	Import scanner results
POST	/api/v2/reimport-scan/	Re-import/update results

Finding Query Parameters

Parameter	Type	Description
severity	string	Critical, High, Medium, Low, Info
active	boolean	Only active findings
verified	boolean	Only verified findings
duplicate	boolean	Include duplicates
product	integer	Filter by product ID
limit	integer	Results per page
offset	integer	Pagination offset

Import Scan

curl -X POST "http://localhost:8080/api/v2/import-scan/" \
  -H "Authorization: Token $TOKEN" \
  -F "product=1" \
  -F "engagement=1" \
  -F "scan_type=Nessus Scan" \
  -F "file=@nessus_export.csv" \
  -F "active=true" \
  -F "verified=false"

Supported Scan Types (partial)

Scanner	scan_type Value
Nessus	Nessus Scan
Qualys	Qualys Scan
Burp Suite	Burp REST API
OWASP ZAP	ZAP Scan
Trivy	Trivy Scan
Snyk	Snyk Scan
Semgrep	Semgrep JSON Report
Nuclei	Nuclei Scan
Checkov	Checkov Scan
SARIF	SARIF

Python Client

import requests

class DefectDojoClient:
    def __init__(self, url, token):
        self.url = url.rstrip("/")
        self.headers = {"Authorization": "Token " + token}

    def get_findings(self, **params):
        return requests.get(
            f"{self.url}/api/v2/findings/",
            headers=self.headers, params=params
        ).json()

references/standards.md (verbatim)

Standards and References - DefectDojo Vulnerability Dashboard

Primary References

DefectDojo Project

• GitHub: https://github.com/DefectDojo/django-DefectDojo
• Documentation: https://defectdojo.github.io/django-DefectDojo/
• API v2 Docs: https://defectdojo.github.io/django-DefectDojo/integrations/api-v2-docs/
• OWASP Project Page: https://owasp.org/www-project-defectdojo/
• License: BSD-3-Clause

Supported Scanner Integrations

• Full List: https://defectdojo.com/integrations
• 200+ parsers including Nessus, Qualys, Burp Suite, ZAP, Trivy, Semgrep, SonarQube, Snyk, Checkov, and more

OWASP Application Security Verification Standard (ASVS)

• URL: https://owasp.org/www-project-application-security-verification-standard/
• Relevance: DefectDojo categorizes findings using OWASP taxonomy

NIST SP 800-53 Rev 5 - RA-5

• Title: Vulnerability Monitoring and Scanning
• Relevance: DefectDojo supports centralized vulnerability tracking as required by RA-5

PCI DSS v4.0 - Requirement 6

• Relevance: DefectDojo tracks application security findings for PCI compliance

Deployment Requirements

Component	Minimum	Recommended
CPU	2 cores	4 cores
RAM	4 GB	8 GB
Disk	20 GB	50 GB+
PostgreSQL	12+	15+
Docker	20.10+	Latest stable
Docker Compose	2.0+	Latest stable

references/workflows.md (verbatim)

Workflows - DefectDojo Vulnerability Dashboard

Workflow 1: Initial Setup and Configuration

Steps

1. Clone DefectDojo repository and deploy with Docker Compose
2. Configure admin account and change default password
3. Create Product Types aligned with business units
4. Create Products for each application/service
5. Configure Jira integration for ticket management
6. Configure Slack/Teams webhook for notifications
7. Set up SLA policies for each severity level
8. Create API keys for scanner integration

Workflow 2: CI/CD Scanner Integration

Steps

1. Add scan step to CI/CD pipeline (GitHub Actions, GitLab CI, Jenkins)
2. Run security scanner (Semgrep, Trivy, ZAP, etc.)
3. Upload scan results to DefectDojo via reimport-scan API
4. DefectDojo deduplicates findings against existing data
5. New findings trigger Jira ticket creation
6. Closed findings auto-close associated Jira tickets
7. Pipeline receives pass/fail status based on finding severity

Workflow 3: Vulnerability Triage

Steps

1. Security analyst reviews new findings in DefectDojo dashboard
2. For each finding: verify, assign severity, set risk acceptance status
3. Valid findings: push to Jira for remediation tracking
4. False positives: mark as false positive with justification
5. Risk accepted: document compensating controls and set expiration
6. Track remediation progress through DefectDojo metrics

Workflow 4: Executive Reporting

Steps

1. Pull metrics via DefectDojo API for reporting period
2. Calculate: total findings, new vs closed, SLA compliance rate
3. Generate product-level and business-unit-level summaries
4. Track mean time to remediate by severity
5. Export dashboard data for executive presentation

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.