New Hook implementation request
Is your feature request related to a problem? Please describe.
As a User i would like to use the OWASP DefectDojo Projekt to analyse my findings (instead or in parallel to my kibana dashboard). While the secureCodeBox has its major focus on the automation part of the security scanner execution, defectDojo is good in visualising, deduplication and analysing the findings.
To integrate OWASP DefectDojo it's necessary to implement a new Hook which pushes the raw finding results of each scanner to the DefectDojo API: ImportScan. DefectDojo can be started as a separate Docker Container or via HelmChart in a K8S cluster environment.
Possible Scanner Integrations:
- NMAP (XML output (use -oX))
- Nikto (XML output)
- ZAP (ZAP XML report format)
Describe the solution you'd like
The is already a working integration solution implemented for the secureCodeBox V1, which maybe can be migrated or reused in the secureCodeBox V2. Therefore the existing code must be wrapped in a Hook.
Describe alternatives you've considered
Another alternative could be implement this hook with a complete green field approach. But this alternative would take much longer and has no real benefits.
Additional context
Steps to implement a new Hook
New Hook implementation request
Is your feature request related to a problem? Please describe.
As a User i would like to use the OWASP DefectDojo Projekt to analyse my findings (instead or in parallel to my kibana dashboard). While the secureCodeBox has its major focus on the automation part of the security scanner execution, defectDojo is good in visualising, deduplication and analysing the findings.
To integrate OWASP DefectDojo it's necessary to implement a new Hook which pushes the raw finding results of each scanner to the DefectDojo API: ImportScan. DefectDojo can be started as a separate Docker Container or via HelmChart in a K8S cluster environment.
Possible Scanner Integrations:
Describe the solution you'd like
The is already a working integration solution implemented for the secureCodeBox V1, which maybe can be migrated or reused in the secureCodeBox V2. Therefore the existing code must be wrapped in a Hook.
Describe alternatives you've considered
Another alternative could be implement this hook with a complete green field approach. But this alternative would take much longer and has no real benefits.
Additional context
Steps to implement a new Hook