Skip to content

Commit ffc03a9

Browse files
mfyllmfyll
authored
Add OpenReports import support (#13562)
* Add OpenReports import support * OpenReports: cleanup * 🚨fix: Lint errors * OpenReports: Add Dedup and non-CVE support * docs: Add OpenReports file import docs * Add scanner name to Test name * Switch dedup method * Move tags to unsaved_tags * Use DEDUPE_ALGO_HASH_CODE * Fix unit tests and move to fix_version in finding * Fix failing tests * Fix tests
1 parent 7e7ecd3 commit ffc03a9

File tree

9 files changed

+852
-0
lines changed

9 files changed

+852
-0
lines changed

‎docs/content/en/connecting_your_tools/parsers/file/openreports.md‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
---
2+
title: "OpenReports"
3+
toc_hide: true
4+
---
5+
6+
Import vulnerability scan reports formatted as [OpenReports](https://github.com/openreports/reports-api).
7+
8+
OpenReports is a Kubernetes-native reporting framework that aggregates vulnerability scan results and compliance checks from various security tools into a unified format. It provides a standardized API for collecting and reporting security findings across your Kubernetes infrastructure.
9+
10+
### File Types
11+
12+
DefectDojo parser accepts a .json file.
13+
14+
### Exporting Reports from Kubernetes
15+
16+
To export OpenReports from your Kubernetes cluster, use kubectl:
17+
18+
```bash
19+
kubectl get reports -A -ojson > reports.json
20+
```
21+
22+
This command retrieves all Report objects from all namespaces and saves them in JSON format. You can then import the `reports.json` file into DefectDojo.
23+
24+
To export reports from a specific namespace:
25+
26+
```bash
27+
kubectl get reports -n <namespace> -ojson > reports.json
28+
```
29+
30+
### Report Formats
31+
32+
The parser supports multiple input formats:
33+
34+
- Single Report object
35+
- Array of Report objects
36+
- Kubernetes List object containing Report items
37+
38+
### Sample Scan Data
39+
40+
Sample OpenReports scans can be found in the [unittests/scans/openreports directory](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/openreports).
41+
42+
### Supported Fields
43+
44+
The parser extracts the following information from OpenReports JSON:
45+
46+
- **Metadata**: Report name, namespace, UID for stable deduplication
47+
- **Scope**: Kubernetes resource information (kind, name, namespace)
48+
- **Results**: Individual security findings with:
49+
- Message and description
50+
- Policy ID (e.g., CVE identifiers)
51+
- Severity (critical, high, medium, low, info)
52+
- Category (e.g., "vulnerability scan", "compliance check")
53+
- Source scanner information
54+
- Package details (name, installed version, fixed version)
55+
- References and URLs
56+
57+
### Severity Mapping
58+
59+
OpenReports severity levels are mapped to DefectDojo as follows:
60+
61+
| OpenReports Severity | DefectDojo Severity |
62+
|----------------------|---------------------|
63+
| critical | Critical |
64+
| high | High |
65+
| medium | Medium |
66+
| low | Low |
67+
| info | Info |
68+
69+
### Result Status Mapping
70+
71+
The `result` field in OpenReports is mapped to DefectDojo finding status:
72+
73+
| OpenReports Result | Active | Verified | Description |
74+
|--------------------|--------|----------|------------------------------------------------|
75+
| fail | True | True | Finding requires attention |
76+
| warn | True | True | Warning-level finding |
77+
| pass | False | False | Check passed, no vulnerability found |
78+
| skip | False | False | Check was skipped |
79+
80+
### Features
81+
82+
**CVE Tracking**: Findings with CVE policy IDs are automatically tagged with vulnerability identifiers.
83+
84+
**Fix Availability**: The parser automatically sets the `fix_available` flag when a fixed version is provided.
85+
86+
**Service Mapping**: Findings are mapped to services based on Kubernetes scope (namespace/kind/name).
87+
88+
**Stable Deduplication**: Uses report UID from metadata for consistent deduplication across reimports.
89+
90+
**Tagging**: Findings are automatically tagged with category, source scanner, and Kubernetes resource kind.
91+
92+
### Example JSON Format
93+
94+
```json
95+
{
96+
"apiVersion": "openreports.io/v1alpha1",
97+
"kind": "Report",
98+
"metadata": {
99+
"name": "deployment-test-app-630fc",
100+
"namespace": "test",
101+
"uid": "b1fcca57-2efd-44d3-89e9-949e29b61936"
102+
},
103+
"scope": {
104+
"kind": "Deployment",
105+
"name": "test-app"
106+
},
107+
"results": [
108+
{
109+
"category": "vulnerability scan",
110+
"message": "openssl: Out-of-bounds read in HTTP client",
111+
"policy": "CVE-2025-9232",
112+
"properties": {
113+
"fixedVersion": "3.5.4-r0",
114+
"installedVersion": "3.5.2-r1",
115+
"pkgName": "libcrypto3",
116+
"primaryURL": "https://avd.aquasec.com/nvd/cve-2025-9232"
117+
},
118+
"result": "warn",
119+
"severity": "low",
120+
"source": "image-scanner"
121+
}
122+
]
123+
}
124+
```
125+
126+
### Default Deduplication Hashcode Fields
127+
128+
By default, DefectDojo identifies duplicate Findings using these [hashcode fields](https://docs.defectdojo.com/en/working_with_findings/finding_deduplication/about_deduplication/):
129+
130+
- unique_id_from_tool (format: `report_uid:policy:package_name`)
131+
- title
132+
- severity
133+
- vulnerability ids (for CVE findings)
134+
- description
135+
136+
The parser uses the report UID from metadata to create a stable `unique_id_from_tool` that persists across reimports.

‎docs/content/supported_tools/parsers/file/openreports.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: "OpenReports"
3+
toc_hide: true
4+
---
5+
Import JSON reports from [OpenReports](https://github.com/openreports/reports-api).
6+
7+
### File Types
8+
9+
DefectDojo parser accepts a .json file.
10+
11+
OpenReports JSON files can be exported from Kubernetes clusters using kubectl:
12+
13+
```bash
14+
kubectl get reports -A -ojson > reports.json
15+
```
16+
17+
The parser supports single Report objects, arrays of Reports, or Kubernetes List objects.
18+
19+
### Sample Scan Data
20+
21+
Sample OpenReports scans can be found in the [unittests/scans/openreports directory](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/openreports).

‎dojo/settings/settings.dist.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1414,6 +1414,7 @@ def saml2_attrib_map_format(din):
14141414
"Cycognito Scan": ["title", "severity"],
14151415
"OpenVAS Parser v2": ["title", "severity", "vuln_id_from_tool", "endpoints"],
14161416
"Snyk Issue API Scan": ["vuln_id_from_tool", "file_path"],
1417+
"OpenReports": ["vulnerability_ids", "component_name", "component_version", "severity"],
14171418
"n0s1 Scanner": ["description"],
14181419
}
14191420

@@ -1487,6 +1488,7 @@ def saml2_attrib_map_format(din):
14871488
"AWS Inspector2 Scan": True,
14881489
"Cyberwatch scan (Galeax)": True,
14891490
"OpenVAS Parser v2": True,
1491+
"OpenReports": True,
14901492
}
14911493

14921494
# List of fields that are known to be usable in hash_code computation)
@@ -1677,6 +1679,7 @@ def saml2_attrib_map_format(din):
16771679
"Cyberwatch scan (Galeax)": DEDUPE_ALGO_HASH_CODE,
16781680
"OpenVAS Parser v2": DEDUPE_ALGO_HASH_CODE,
16791681
"Snyk Issue API Scan": DEDUPE_ALGO_HASH_CODE,
1682+
"OpenReports": DEDUPE_ALGO_HASH_CODE,
16801683
}
16811684

16821685
# Override the hardcoded settings here via the env var

‎dojo/tools/openreports/__init__.py‎

Whitespace-only changes.

0 commit comments

Comments
 (0)