Aqua | DefectDojo Documentation

Aqua

File Types

DefectDojo parser accepts JSON report format.

See Aqua documentation: https://docs.aquasec.com

CI/CD Scans

Aqua scanning can be integrated with several types of third-party CI/CD systems.

If there is no plugin available for a particular development tool, Aqua can be integrated with the CI/CD pipeline using Scanner CLI.

CI/CD scans produce JSON scan reports that are supported by the parser. With this kind of report, the parser is able to retrieve vulnerabilities as well as sensitive data.

REST API

You can also retrieve the JSON directly from Aqua if you use one of the following endpoints:

Example

curl -X GET <aquaseceurl>/api/v1/scanner/registry/<registryName>/image/<imageName>/scan_result > report.json

curl -X GET <aquaseceurl>/api/v2/risks/vulnerabilities?show_negligible=true&image_name_exact_match=true&registry_name=<registryName>&image_name=<imageName> > report.json

Those JSON files will only list vulnerabilities. Thus, the DefectDojo parser will not retrieve findings such as sensitive data.

Sample Scan Data

Sample Aqua scans can be found here.

Default Deduplication Hashcode Fields

By default, DefectDojo identifies duplicate findings using these hashcode fields: