Integrators Tool Reference | DefectDojo Documentation
Integrators Tool Reference (Pro)
Here are specific instructions detailing how to set up a DefectDojo Integration with a third party Issue Tracker.
Azure DevOps Boards
Instance Setup
- Label should be the label that you want to use to identify this integration.
- Location should be set to your Azure URL - for example
https://dev.azure.com/{your organization} - Token should be set to a personal access token from Azure.
Authentication with Azure DevOps requires a personal access token with permissions set to “Read, Write and Manage” for “Work Items” for the Azure Project that you wish to work with.
Issue Tracker Mapping
These details dictate how DefectDojo will map Finding or Finding Group attributes to a given Project in Azure DevOps:
Issue Tracker Mapping Details
The Project ID field corresponds to the name or the ID of the Project in Azure.
Severity Mapping Details
The attributes in the form are supplied as defaults, and are as follows:
- Severity Field Name:
/fields/Microsoft.VSTS.Common.Priority - Info Mapping:
4 - Low Mapping:
4 - Medium Mapping:
3 - High Mapping:
2 - Critical Mapping:
1
Status Mapping Details
The attributes in the form are supplied as defaults and are as follows:
- Status Field Name:
/fields/System.State - Active Mapping:
To Do - Closed Mapping:
Done - False Positive Mapping:
Done - Risk Accepted Mapping:
Done
Bitbucket
The Bitbucket integration allows you to push issues to the issue tracker of a Bitbucket Cloud repository.
The issue tracker is optional in Bitbucket and must be enabled on the repository before DefectDojo can create Issues in it. To enable it, open the repository in Bitbucket and select Repository settings, then enable the issue tracker under Features.
Instance Setup
- Label should be the label that you want to use to identify this integration.
- Location should be set to
https://bitbucket.org. - Email should be the email address of the Atlassian account that the API token belongs to.
- API Token should be set to a scoped Atlassian API token.
Bitbucket app passwords are deprecated by Atlassian and will not work with this integration. To create an API token:
- Open Atlassian account settings and choose Security, then Create and manage API tokens.
- Choose Create API token with scopes, name the token, and set an expiry date.
- Select Bitbucket as the app.
- Grant the token permission to read repositories and to read and write issues.
Issue Tracker Mapping
- Workspace should be the slug of the workspace that contains the repository, as it appears in bitbucket.org URLs.
- Repository Slug should be the slug of the repository that you want to create Issues in.
Severity Mapping Details
This maps to the Bitbucket issue Priority field. The attributes in the form are supplied as defaults, and each value must be one of Bitbucket’s priorities: trivial, minor, major, critical, or blocker.
- Severity Field Name:
priority - Info Mapping:
trivial - Low Mapping:
minor - Medium Mapping:
major - High Mapping:
critical - Critical Mapping:
blocker
Status Mapping Details
This maps to the Bitbucket issue State field. Each value must be one of Bitbucket’s issue states: new, open, resolved, on hold, invalid, duplicate, wontfix, or closed.
- Status Field Name:
state - Active Mapping:
new - Closed Mapping:
resolved - False Positive Mapping:
invalid - Risk Accepted Mapping:
wontfix
GitHub
The GitHub integration allows you to add issues to a GitHub Project, which also open Issues in an associated Repo. These Repos/Projects can be associated with either a GitHub Organization or a personal GitHub account.
Instance Setup
- Label should be the label that you want to use to identify this integration.
- Location should be set to your GitHub User or Organization URL, depending on where you wish to create issues. for example
https://github.com/{your-organization} - Token should be set to a personal access token from GitHub.
Personal access tokens for GitHub can be created at https://github.com/settings/tokens. The token must have Repo and Project scopes.
Issue Tracker Mapping
- Issue Tracker Mapping Label should be set to identify the Project or Repo that you wish to create Issues in.
- Project Number should be the ID of a GitHub project that you want to send items to. You can get this from the URL while looking at a Project, for example
https://github.com/orgs/{your-org}/projects/{project number}. - Repository Name should be the name of a repo associated with your organization (or user) that you want to push Issues to.
Severity Mapping Details
In order to set up the integration, the Project MUST have a custom field created to represent Issue Priority, otherwise Severity will not be mapped correctly and Issues will not push to GitHub.
Follow this guide to create a custom field. Each Severity will need to have a corresponding single-select option available. For example, out of the box DefectDojo suggests P0, P1, P2, P3, P4 as possible Priority values, and each of those will need to be added to the Priority custom field.
- Severity Field Name:
Priority - Info Mapping:
P0 - Low Mapping:
P1 - Medium Mapping:
P2 - High Mapping:
P3 - Critical Mapping:
P4
Status Mapping Details
By default, new GitHub Projects will have Statuses for Issues of “In Progress” and “Done”. Additional statuses can be added to the Project to track False Positive or Risk Accepted status if you wish. One of the ways this can be done is by adding a new Status Column to the Project Board.
- Status Field Name:
Status - Active Mapping:
In Progress - Closed Mapping:
Done - False Positive Mapping:
Done - Risk Accepted Mapping:
Done
GitLab
The GitLab integration allows you to add issues to a GitLab Project.
Instance Setup
- Label should be the label that you want to use to identify this integration.
- Location should be set to the link to your GitLab server, for example
https://gitlab.com/. - Token should be set to a personal access token from GitLab. The token must have API scopes. See GitLab’s guide to creating a personal access token.
Issue Tracker Mapping
- Project Name: The name of the project in GitLab that you want to send issues to.
Severity Mapping Details
This maps to the GitLab Priority field.
- Severity Field Name:
Priority - Info Mapping:
1 - Low Mapping:
2 - Medium Mapping:
3 - High Mapping:
4 - Critical Mapping:
5
Status Mapping Details
By default, GitLab has statuses of ‘opened’ and ‘closed’. Additional status labels can be added if you want to track False Positive or Risk Accepted status. See GitLab Docs for details.
- Status Field Name:
Status - Active Mapping:
opened - Closed Mapping:
closed - False Positive Mapping:
closed - Risk Accepted Mapping:
closed
Jira
The Jira integration pushes DefectDojo Findings and Finding Groups to a Jira project as issues, keeps each issue’s status in sync with the Finding, and links the Finding back to the created issue. Both Jira Cloud and Data Center / Server are supported. Jira Service Management is not supported.
Choosing an authentication method
Set Jira Deployment first, then pick an Authentication Method:
Jira Cloud
- API Token (email + token) — HTTP Basic auth using an Atlassian account email and an API token. Calls go directly to your site URL.
- OAuth 2.0 (recommended) — a one-time browser consent; DefectDojo obtains and refreshes the tokens for you.
- Service Account Token — a scoped API token created for an Atlassian service account.
Jira Data Center / Server
- Personal Access Token (recommended)
- Username + Password
Instance Setup
- Label should be the label you want to use to identify this integration.
- Location should be set to your Jira site URL, for example
https://your-organization.atlassian.net. This is used for the browsable ticket links, and — for API Token and Data Center auth — as the API base URL. - The remaining fields depend on the method you chose above (email + API token, OAuth client credentials, service-account token, PAT, or username + password).
Issue Tracker Mapping
- Project Key: the key of the Jira project to create issues in, for example
SEC. - Issue Type: the issue type to create, for example
BugorTask. Defaults toBug.
Severity Mapping Details
Defaults match Jira’s default priority scheme. Edit them to match the priority names in your project:
- Severity Field Name:
priority - Info Mapping:
Lowest - Low Mapping:
Low - Medium Mapping:
Medium - High Mapping:
High - Critical Mapping:
Highest
Status Mapping Details
Statuses vary per project workflow, so these defaults are meant to be edited to your workflow’s status names:
- Status Field Name:
status - Active Mapping:
To Do - Closed Mapping:
Done - False Positive Mapping:
Done - Risk Accepted Mapping:
Done
Custom Fields (optional)
You can map additional Jira fields — for example a required resolution on close, or labels — in the mapping’s Custom Fields step. Each custom-field mapping has four parts:
- Source — where the value comes from: an attribute of the Finding, Test, Engagement, or Asset being pushed, or a Static value.
- Value — for an object source, the specific attribute to read, chosen from a list of that object’s fields with human-readable labels (for example Severity, CVE, Mitigation). For a Static value source this is a free-text box you type the literal value into.
- Vendor Field — the Jira field to write to. Because DefectDojo can read Jira’s field catalog, this is a searchable picker that lists each field by its display name and resolves it to the internal id for you — so you select DD Close Justification and DefectDojo stores
customfield_10255. The picker is populated from the connection, so it works once the connection is saved and validated. - Application point — when to send the field: on ticket creation, on every update, or as part of a specific status transition (Active / Closed / False Positive / Risk Accepted). A transition-scoped field is sent as part of that transition’s edit — this is how you supply a value Jira only accepts on a transition screen, most commonly a
resolutionyour workflow requires when an issue is resolved.
Ticket Templates (optional)
By default Jira issues use DefectDojo’s built-in title and body. To customize them, attach a Ticket Template to the mapping in its Ticket Template step. A template defines four independently-optional pieces — the Finding summary and description, and the Finding Group summary and description. Any piece left blank falls back to the built-in default, so you can override just the title, just the body, or all four. Use Test render in the template editor to preview the rendered output against sample data — catching mistakes such as unknown placeholders or values that exceed a field’s length limit — before saving. If a template is later deleted, the mappings that used it revert to the built-in defaults automatically.
How it works
- Create / Update / Delete: creating pushes a new issue and records the link on the Finding; updating edits the existing issue; deleting a Finding force-closes its issue (nothing is deleted in Jira). Pushes can be manual (“Push to Integrators”) or automatic per the Issue Tracker Assignment.
- Status reconciliation: after creating (and on every update) DefectDojo reads the issue’s current status and, if it differs from the mapped target, finds a single workflow transition that reaches it and applies it. If no such transition exists, the mapping records an error rather than failing silently. Any transition-scoped custom fields are sent with that transition.
- Ticket link: the link surfaced on the Finding is
https://your-site.atlassian.net/browse/{ISSUE-KEY}— always your public site URL, never the internal gateway. - Token lifecycle (OAuth): DefectDojo owns the whole flow — it performs the authorization-code exchange, stores the access and refresh tokens, and refreshes on demand before a push, persisting the new refresh token each time (Atlassian rotates it on every refresh).
- Credential storage: all connection credentials (passwords, tokens, client secrets, OAuth tokens) are encrypted at rest and are never returned through the API — editing a connection shows a “leave blank to keep” placeholder for stored secrets.
Linear
The Linear integration allows you to push DefectDojo Findings as Linear Issues. Issues are created in a Team in your Linear workspace.
Instance Setup
- Label should be the label that you want to use to identify this integration.
- Location should be set to
https://api.linear.app/graphql. - API Key should be set to a Linear personal API key. Keys can be generated in Linear under Settings, then Security & access, then API.
Issue Tracker Mapping
- Team (Group) ID should be set to the ID of the Linear Team that Issues will be created for. You can list your Teams and their IDs by calling the Linear GraphQL API:
curl -H "Authorization: {{API_KEY}}" -H "Content-Type: application/json"
-d '{"query":"{ teams { nodes { id name key } } }"}' https://api.linear.app/graphql
Severity Mapping Details
A Linear Issue carries a numeric priority rather than a severity field. Each DefectDojo severity maps to a Linear priority, where 1 is Urgent and 4 is Low:
- Severity Field Name:
Priority - Info Mapping:
4 - Low Mapping:
4 - Medium Mapping:
3 - High Mapping:
2 - Critical Mapping:
1
Status Mapping Details
Each status value must be set to the ID of a Workflow State in your Linear Team. Workflow State IDs are unique to each workspace, so there are no default values. You can list the Workflow States and their IDs by calling the Linear GraphQL API:
curl -H "Authorization: {{API_KEY}}" -H "Content-Type: application/json"
-d '{"query":"{ workflowStates { nodes { id name type team { key } } } }"}' https://api.linear.app/graphql
- Status Field Name:
Workflow State ID - Active Mapping: the ID of a started or unstarted state, for example
TodoorIn Progress. - Closed Mapping: the ID of a completed state, for example
Done. When a Finding is deleted in DefectDojo, its Issue is moved to this state.
PagerDuty
The PagerDuty Integration allows you to push DefectDojo Findings and Finding Groups as PagerDuty Incidents, opened on a PagerDuty Service of your choice.
Instance Setup
- Label should be the label that you want to use to identify this integration.
- Location should be set to
https://api.pagerduty.com. If your PagerDuty account is hosted in the EU service region, usehttps://api.eu.pagerduty.cominstead. - API Token should be set to a PagerDuty REST API key. An account administrator can create one in the PagerDuty web app under Integrations > API Access Keys > Create New API Key. Leave “Read-only” unchecked - DefectDojo needs to create and update incidents.
- From Email should be the email address of a valid user on your PagerDuty account. PagerDuty requires this address when creating or updating incidents, and it will be shown as the incident requester.
Issue Tracker Mapping
- Service ID should be the ID of the PagerDuty Service that incidents will be opened on. You can find it at the end of the URL while looking at the Service in PagerDuty, for example
https://{your-subdomain}.pagerduty.com/service-directory/{service id}.
Severity Mapping Details
By default this maps to the PagerDuty incident Urgency field, which only accepts high or low:
- Severity Field Name:
Urgency - Info Mapping:
low - Low Mapping:
low - Medium Mapping:
low - High Mapping:
high - Critical Mapping:
high
Alternatively, if your PagerDuty account has Priorities enabled, you can map severities to Priority names instead. Set the Severity Field Name to Priority and use your account’s Priority names (for example P1 through P5) as the mapping values. When mapping to Priority, the incident’s Urgency is left to your Service’s own urgency rules.
Status Mapping Details
PagerDuty incidents have three statuses: triggered, acknowledged, and resolved.
- Status Field Name:
Status - Active Mapping:
triggered - Closed Mapping:
resolved - False Positive Mapping:
resolved - Risk Accepted Mapping:
acknowledged
ServiceNow
The ServiceNow Integration allows you to push DefectDojo Findings as ServiceNow Incidents.
Instance Setup
DefectDojo authenticates to ServiceNow over OAuth 2.0. How you create the OAuth credentials depends on your ServiceNow release — newer releases (Zurich and later) use a Client Credentials grant, while earlier releases use a refresh token.
ServiceNow Zurich and later (client credentials)
Recent ServiceNow releases deprecated the classic “Create an OAuth API endpoint for external clients” option in favor of the New Inbound Integration Experience, which issues an OAuth Client Credentials grant bound to a service account:
- In the left-hand navigation bar, search for “Application Registry” and select it.
- Click New, then choose New Inbound Integration Experience.
- Select New Integration → OAuth - Client credentials grant.
- Set the OAuth Application User to the service account that will create Incidents. That account’s roles determine what DefectDojo is allowed to write.
- Save the registration. ServiceNow auto-generates the Client ID and Client Secret (leave those fields blank when creating the registration).
Then, in DefectDojo:
- Instance Label should be the label that you want to use to identify this integration.
- Location should be set to the URL for your ServiceNow server, for example
https://your-organization.service-now.com/. - Client ID should be the Client ID from the OAuth registration.
- Client Secret should be the Client Secret from the OAuth registration.
Leave the Refresh Token, Username, and Password fields empty — DefectDojo requests a fresh client-credentials token for each sync.
Severity Mapping Details
This maps to the ServiceNow Impact field.
- Info Mapping:
1 - Low Mapping:
1 - Medium Mapping:
2 - High Mapping:
3 - Critical Mapping:
3
Status Mapping Details
- Status Field Name:
State - Active Mapping:
New - Closed Mapping:
Closed - False Positive Mapping:
Resolved - Risk Accepted Mapping:
Resolved
Shortcut
The Shortcut integration allows you to push DefectDojo Findings as Shortcut Stories. Stories are created with the story type of Bug and assigned to a Team in your Shortcut workspace.
Instance Setup
- Label should be the label that you want to use to identify this integration.
- Location should be set to
https://api.app.shortcut.com. - API Token should be set to a Shortcut API token. Tokens can be generated in Shortcut under Settings, then Your Account, then API Tokens.
Issue Tracker Mapping
- Team (Group) ID should be set to the UUID of the Shortcut Team that Stories will be created for. You can find this UUID by opening the Team page in Shortcut and copying the identifier from the URL, or by calling the Shortcut API:
curl -H "Shortcut-Token: {{API_TOKEN}}" https://api.app.shortcut.com/api/v3/groups
Severity Mapping Details
Each severity value is applied to the Story as a label. Labels are created automatically in Shortcut if they do not already exist, so the default values below can be used as they are, or replaced with label names of your choosing. When a Finding’s severity changes, the old severity label is removed from the Story and the new one is added.
- Severity Field Name:
Label - Info Mapping:
sev-info - Low Mapping:
sev-low - Medium Mapping:
sev-medium - High Mapping:
sev-high - Critical Mapping:
sev-critical
Status Mapping Details
Each status value must be set to the numeric ID of a Workflow State in your Shortcut workspace. Workflow State IDs are unique to each workspace, so there are no default values. You can list the Workflow States and their IDs by calling the Shortcut API:
curl -H "Shortcut-Token: {{API_TOKEN}}" https://api.app.shortcut.com/api/v3/workflows
- Status Field Name:
Workflow State ID - Active Mapping: the ID of the state for open work, for example a Backlog or To Do state.
- Closed Mapping: the ID of a Done type state. When a Finding is deleted in DefectDojo, its Story is moved to this state.
Freshservice
The Freshservice Integration allows you to push DefectDojo Findings and Finding Groups as Freshservice tickets, assigned to an agent Group of your choice.
Instance Setup
- Label should be the label that you want to use to identify this integration.
- Location should be set to your Freshservice URL:
https://yourcompany.freshservice.com. - API Key should be a Freshservice API key. Find it by clicking your profile picture (top right) > Profile settings - the key appears on the right below the Delegate Approvals section, after you complete the captcha. If no key is shown there, API access may be disabled at the account level and an administrator has to enable it first.
- Requester Email should be the email address tickets are requested on behalf of. Freshservice requires a requester on every ticket, so DefectDojo creates tickets with this address as the requester.
Issue Tracker Mapping
- Group ID should be the numeric ID of the Freshservice agent group tickets will be assigned to. Find it in the URL while viewing the group under Admin > Agent Groups.
- Workspace ID (optional) routes tickets to a specific workspace on multi-workspace accounts. Leave it empty to use the primary workspace.
Severity Mapping Details
This maps to the Freshservice ticket Priority field, which uses numeric codes (1 Low, 2 Medium, 3 High, 4 Urgent). The priority names are also accepted:
- Severity Field Name:
Priority - Info Mapping:
1 - Low Mapping:
1 - Medium Mapping:
2 - High Mapping:
3 - Critical Mapping:
4
Status Mapping Details
This maps to the ticket Status field, which uses numeric codes (2 Open, 3 Pending, 4 Resolved, 5 Closed). The status names are also accepted:
- Status Field Name:
Status - Active Mapping:
2 - Closed Mapping:
5 - False Positive Mapping:
5 - Risk Accepted Mapping:
3
ServiceDesk Plus
The ManageEngine ServiceDesk Plus Integration allows you to push DefectDojo Findings and Finding Groups as ServiceDesk Plus requests, assigned to a support Group of your choice. Both the cloud (ServiceDesk Plus OnDemand) and on-premises editions are supported by the same integration - the credentials you provide determine which mode is used.
Instance Setup
- Label should be the label that you want to use to identify this integration.
- Location should be set to your ServiceDesk Plus URL:
https://sdpondemand.manageengine.comfor the cloud edition (or your regional equivalent), or your server’s address for on-premises installs.
Then provide one of the two credential sets:
On-premises: Technician Key
- Technician Key should be an API key generated for a technician on your server, under Admin > General Settings > API. Leave the Zoho OAuth fields empty.
Cloud: Zoho OAuth
The cloud edition authenticates through Zoho Accounts OAuth:
- Open the Zoho API Console and create a Self Client.
- Note the Client ID and Client Secret.
- In the Self Client’s “Generate Code” tab, enter the scope
SDPOnDemand.requests.ALL, choose a duration, and generate the code. - Exchange the code for a refresh token:
curl --request POST \
--url 'https://accounts.zoho.com/oauth/v2/token' \
--data 'grant_type=authorization_code' \
--data 'client_id={{CLIENT_ID}}' \
--data 'client_secret={{CLIENT_SECRET}}' \
--data 'code={{GENERATED_CODE}}'
- Enter the Client ID, Client Secret, and the returned Refresh Token in the instance form. If your account is hosted outside the US data center, set Token URL to your regional Zoho Accounts endpoint (for example
https://accounts.zoho.eu/oauth/v2/token).
Issue Tracker Mapping
- Group Name should be the name of the ServiceDesk Plus support group requests will be assigned to, exactly as it appears under Admin > Users > Support Groups.
Severity Mapping Details
This maps to the ServiceDesk Plus request Priority field by name, using your account’s priority names:
- Severity Field Name:
Priority - Info Mapping:
Low - Low Mapping:
Normal - Medium Mapping:
Medium - High Mapping:
High - Critical Mapping:
High
Status Mapping Details
This maps to the request Status field by name. The defaults use the built-in statuses:
- Status Field Name:
Status - Active Mapping:
Open - Closed Mapping:
Closed - False Positive Mapping:
Closed - Risk Accepted Mapping:
On Hold
Zendesk
The Zendesk Integration allows you to push DefectDojo Findings and Finding Groups as Zendesk tickets, assigned to a Zendesk Group of your choice.
Instance Setup
- Label should be the label that you want to use to identify this integration.
- Location should be set to your Zendesk account URL, for example
https://your-subdomain.zendesk.com. - Email should be the email address of the Zendesk agent the API token belongs to.
- API Token should be set to a Zendesk API token. An administrator can create one in the Zendesk Admin Center under Apps and integrations > APIs > Zendesk API (token access must be enabled).
Issue Tracker Mapping
- Group ID should be the numeric ID of the Zendesk Group that tickets will be assigned to. You can find it in the Admin Center under People > Team > Groups, or in the URL while viewing the group.
Severity Mapping Details
This maps to the Zendesk ticket Priority field, which accepts low, normal, high, and urgent:
- Severity Field Name:
Priority - Info Mapping:
low - Low Mapping:
low - Medium Mapping:
normal - High Mapping:
high - Critical Mapping:
urgent
Status Mapping Details
Zendesk tickets support the statuses new, open, pending, hold, solved, and closed. Note that hold must be enabled on your account before it can be used.
- Status Field Name:
Status - Active Mapping:
new - Closed Mapping:
solved - False Positive Mapping:
solved - Risk Accepted Mapping:
pending.