Package: dd-import
dd-importA utility to (re-)import findings and language data intoDefectDojoFindings and languages can be imported into DefectDojo via anAPI. To make automated build and deploy pipelines easier to implement,dd-importprovides some convenience functions:Product types, products, engagements and tests will be created if they are not existing. This avoids manual preparation in DefectDojo or complicated steps within the pipeline.Product types, products, engagements and tests are referenced by name. This make pipelines more readable than using IDs.Build information forbuild_id,commit_hashandbranch_tagcan be updated when uploading findings.No need to deal withcurland its syntax within the pipeline. This makes pipelines shorter and better readable.All parameters are provided via environment variables, which works well with pipeline definitions like GitHub Actions or GitLab CI.User guideInstallation and commandsPythondd-importcan be installed with pip. Only Python 3.8 and up is supported.pipinstalldd-importThe commanddd-reimport-findingsre-imports findings into DefectDojo. Even though the name suggests otherwise, you do not need to do an initial import first.The commanddd-import-languagesimports languages data that have been gathered with the toolcloc, seeLanguages and lines of codefor more details.DockerDocker images can be found inhttps://hub.docker.com/r/maibornwolff/dd-import.A re-import of findings can be started withdockerrun--rmdd-import:latestdd-reimport-findings.shImporting languages data can be started withdockerrun--rmdd-import:latestdd-import-languages.shPlease note you have to set the environment variables as described below and mount a folder containing the file with scan results when running the docker container./usr/local/dd-importis the working directory of the docker image, all commands are located in the/usr/local/dd-import/binfolder.ParametersAll parameters need to be provided as environment variables:ParameterRe-import findingsImport languagesRemarkDD_URLMandatoryMandatoryBase URL of the DefectDojo instanceDD_API_KEYMandatoryMandatoryShall be defined as a secret, eg. a protected variable in GitLab or an encrypted secret in GitHubDD_PRODUCT_TYPE_NAMEMandatoryMandatoryIf a product type with this name does not exist, it will be createdDD_PRODUCT_NAMEMandatoryMandatoryIf a product with this name does not exist, it will be createdDD_ENGAGEMENT_NAMEMandatory-If an engagement with this name does not exist for the given product, it will be createdDD_ENGAGEMENT_TARGET_STARTOptional-Format: YYYY-MM-DD, default:today. The target start date for a newly created engagement.DD_ENGAGEMENT_TARGET_ENDOptional-Format: YYYY-MM-DD, default:2999-12-31. The target start date for a newly created engagement.DD_TEST_NAMEMandatory-If a test with this name does not exist for the given engagement, it will be createdDD_TEST_TYPE_NAMEMandatory-From DefectDojo's list of test types, eg.Trivy ScanDD_FILE_NAMEOptionalMandatoryDD_ACTIVEOptional-Default:trueDD_VERIFIEDOptional-Default:trueDD_MINIMUM_SEVERITYOptional-DD_GROUP_BYOptional-Group by file path, component name, component name + versionDD_PUSH_TO_JIRAOptional-Default:falseDD_CLOSE_OLD_FINDINGSOptional-Default:trueDD_CLOSE_OLD_FINDINGS_PRODUCT_SCOPEOptional-Default:falseDD_DO_NOT_REACTIVATEOptional-Default:falseDD_VERSIONOptional-DD_ENDPOINT_IDOptional-DD_SERVICEOptional-DD_BUILD_IDOptional-DD_COMMIT_HASHOptional-DD_BRANCH_TAGOptional-DD_API_SCAN_CONFIGURATION_IDOptional-Id of the API scan configuration for API based parsers, e.g. SonarQubeDD_SOURCE_CODE_MANAGEMENT_URIOptional-DD_SSL_VERIFYOptionalOptionalDisable SSL verification by setting tofalseor0. Default:trueDD_EXTRA_HEADER_1OptionalOptionalIf extra header key is needed for auth in wafs or similarDD_EXTRA_HEADER_1_VALUEOptionalOptionalThe corresponding value for extra header keyDD_EXTRA_HEADER_2OptionalOptionalIf extra header key is needed for auth in wafs or similarDD_EXTRA_HEADER_2_VALUEOptionalOptionalThe corresponding value for extra header keyUsageThis snippet from aGitLab CI pipelineserves as an example howdd-importcan be integrated to upload data during build and deploy using the docker image:variables:DD_PRODUCT_TYPE_NAME:"Showcase"DD_PRODUCT_NAME:"DefectDojoImporter"DD_ENGAGEMENT_NAME:"GitLab"...trivy:stage:testtags:-buildvariables:GIT_STRATEGY:nonebefore_script:-export TRIVY_VERSION=$(wget -qO - "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/')-echo $TRIVY_VERSION-wget --no-verbose https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz -O - | tar -zxvf -allow_failure:truescript:-./trivy --exit-code 0 --no-progress -f json -o trivy.json maibornwolff/dd-import:latestartifacts:paths:-trivy.jsonwhen:alwaysexpire_in:1 daycloc:stage:testimage:node:16tags:-buildbefore_script:-npm install -g clocscript:-cloc src --json -out cloc.jsonartifacts:paths:-cloc.jsonwhen:alwaysexpire_in:1 dayupload_trivy:stage:uploadimage:maibornwolff/dd-import:latestneeds:-job:trivyartifacts:truevariables:GIT_STRATEGY:noneDD_TEST_NAME:"Trivy"DD_TEST_TYPE_NAME:"TrivyScan"DD_FILE_NAME:"trivy.json"script:-dd-reimport-findings.shupload-cloc:image:maibornwolff/dd-import:latestneeds:-job:clocartifacts:truestage:uploadtags:-buildvariables:DD_FILE_NAME:"cloc.json"script:-dd-import-languages.shvariables- Definition of some environment variables that will be used for several uploads.DD_URLandDD_API_KEYare not defined here because they are protected variables for the GitLab project.trivy- Example for a vulnerability scan withtrivy. Output will be stored in JSON format (trivy.json).cloc- Example how to calculate the lines of code withcloc. Output will be stored in JSON format (cloc.json).upload_trivy- This step will be executed after thetrivystep, gets its output file and sets some variables specific for this step. Then the script to import the findings from this scan is executed.upload_cloc- This step will be executed after theclocstep, gets its output file and sets some variables specific for this step. Then the script to import the language data is executed.Another example, showing how to usedd-importwithin a GitHub Action, can be found indd-import_example.yml.Developer guideTesting./bin/runUnitTests.sh- Runs the unit tests and reports the test coverage../bin/runDockerUnitTests.sh- First creates the docker image and then starts a docker container in which the unit tests are executed.LicenseLicensed under the3-Clause BSD License