Hari 47: DefectDojo API — 7 Scans, 16 Findings Centralized

Day 46 setup DefectDojo (7 containers, port 8088). Hari ini integrate — upload 7 scanner reports ke DefectDojo via import-scan API. 15 tests imported, 46 findings centralized. Single pane of glass achieved.

upload-scans.sh — Automated Upload Script

#!/usr/bin/env bash
# Upload 7 scanner reports to DefectDojo

# 1. Get API token via /api/v2/api-token-auth/
# 2. Upload reports via /api/v2/import-scan/
# 3. Print summary: tests count, findings count

$ bash upload-scans.sh
=== Uploading scanner reports ===
  OK: Trivy Scan -> test_id=9 (trivy-fs-report.json)
  OK: Trivy Scan -> test_id=10 (trivy-image-report.json)
  OK: Trivy Scan -> test_id=11 (trivy-iac-report.json)
  OK: Trivy Scan -> test_id=12 (trivy-k8s-post-fix-report.json)
  OK: Semgrep JSON Report -> test_id=13 (semgrep-report.json)
  OK: Checkov Scan -> test_id=14 (checkov-report.json)
  OK: Checkov Scan -> test_id=15 (checkov-k8s-post-fix-report.json)

=== Summary ===
Tests imported: 15
Findings: 46

Scanner Compatibility

Scanner	Format	scan_type	Compatible	Findings
Trivy FS	JSON	Trivy Scan	✅	0 (clean)
Trivy Image	JSON	Trivy Scan	✅	0 (distroless, 0 CVE)
Trivy IaC	JSON	Trivy Scan	✅	0 (clean)
Trivy K8s	JSON	Trivy Scan	✅	0 (clean)
Semgrep	JSON	Semgrep JSON Report	✅	1 (Medium: TLS audit)
Checkov IaC	JSON	Checkov Scan	✅	0 (102 passed, 0 failed)
Checkov K8s	JSON	Checkov Scan	✅	15 (Medium: SG/S3/KMS)
ZAP	JSON	ZAP Scan	❌	Wrong format — needs XML

7/8 successful. ZAP butuh XML, bukan JSON. Skip untuk sekarang (1 false positive only).

CI Job: upload-defectdojo (Conditional)

  upload-defectdojo:
    name: DefectDojo Upload
    needs: [sca-scan, sast-scan, iac-checkov, iac-trivy]
    if: ${{ vars.DEFECTDOJO_URL != '' }}  # Skip kalau local
    steps:
      - Download artifacts (trivy, semgrep, checkov)
      - Upload to DefectDojo via import-scan API

Conditional skip: if: vars.DEFECTDOJO_URL != ''

• Local: secret tidak ada → job skip → pakai upload-scans.sh manual
• Production: deploy DefectDojo cloud → set secrets → CI auto-upload

Local vs CI Split

Aspek	Local (current)	CI (production)
URL	http://localhost:8088	https://defectdojo.company.com
Trigger	Manual bash upload-scans.sh	Automatic di setiap push/PR
Reports	All 7 local reports	Artifacts dari CI jobs
Speed	~3 seconds	After CI scans complete (~5 min)

Terminology Mapping (Day 46 Fix)

API v2 (curl)	UI v3.x (browser)	Our Value
Product Type	Organization	Fintech
Product	Asset	SecureBank API
Engagement	Engagement (unchanged)	Q3 Security Audit

Tutorial pakai terminology lama. UI v3.x sudah rename. API v2 tetap pakai nama lama — curl commands work.

Pelajaran Hari Ini

Single pane of glass achieved. 7 scanner reports dari 4 tools centralized di 1 dashboard. 46 findings dari 2 scanners (Semgrep + Checkov K8s). Visibility > siloed reports.

DefectDojo import-scan API. Endpoint /api/v2/import-scan/ terima multipart form: scan_type, product_name, engagement_name, file. scan_type butuh exact match.

Conditional CI jobs. if: vars.DEFECTDOJO_URL != '' = skip kalau secret tidak ada. Berguna untuk local vs production split.

Scanner format compatibility. DefectDojo support JSON untuk Trivy/Semgrep/Checkov, tapi butuh XML untuk ZAP. Selalu cek scan_type compatibility.

Terminology drift. API v2 tetap pakai "Product Type/Product", UI v3.x rename ke "Organization/Asset". Tutorial outdated. Verify dengan actual UI.

Repo

Semua code dan dokumentasi ada di: https://github.com/stayrelevantid/chalange-devsecops

Kesimpulan

DefectDojo API integration complete. 7 scanner reports uploaded, 15 tests imported, 46 findings centralized. upload-scans.sh untuk local, conditional CI job untuk production. ZAP needs XML (documented). Terminology mapping fixed. Single pane of glass achieved! Besok Day 48 — Intelligent Alert Routing (Slack).