Dependency-Track logov4.10

Dependency-Track can automatically publish results to DefectDojo providing a consolidated view of security-centric code findings and vulnerable component findings.

Dependency-Track accomplishes this in the following ways:

Requirements:

Dependency-Track Configuration #

DefectDojo Configuration #

Step 1: Create a product (or navigate to one you’ve created already #

Create a product

Step 2: Create a CI/CD engagement for your product #

Create CI/CD engagement menu Create CI/CD engagement

Step 3: Note down the ID of the new engagement #

Note engagement ID

Step 4: Note down your API key #

Note API Key Note API Key

Step 5: Add the API key in Dependency-Track configuration #

Configure DefectDojo Integration

Step 6: Add Per-project configuration #

Configure Project Dependency-Track includes the ability to specify configuration properties on a per-project basis. Navigate to Projects / ‘Your Project’, then click on ‘View Details’ to open ‘Project Details’ page; then click on ‘Properties’ button; click on ‘Create Property’. This feature is used to map projects in Dependency-Track to engagements in DefectDojo.

Attribute Value  
Group Name integrations  
Property Name defectdojo.engagementId  
Property Value The CI/CD engagement ID to upload findings to, noted in Step 3 s
Property Type STRING  

Step 7: Add Per-project configuration for Reimport Enhancement (Optional) #

Attribute Value
Group Name integrations
Property Name defectdojo.reimport
Property Value ‘true’
Property Type BOOLEAN

Step 8: Add Per-project configuration for do_not_reactivate Enhancement (Optional) #

Configure Project

As mentioned in the DefectDojo documentation this feature ‘Will keep existing findings closed, without reactivating them.’ Usually DefectDojo considers the scanners report as the source of truth, this leads DefectDojo to re-open findings that might have been closed in DefectDojo if it shows up in a scan.

Attribute Value
Group Name integrations
Property Name defectdojo.doNotReactivate
Property Value ‘true’
Property Type BOOLEAN

Step 9: Global configuration for Reimport Enhancement (Optional) #