Semgrep Pro JSON Report

Import Semgrep Pro findings in JSON format.

Sample Scan Data

Sample Semgrep Pro JSON Report scans can be found here.

Default Deduplication

By default, DefectDojo uses the match_based_id from Semgrep Pro for deduplication. If this is not available, it falls back to using a combination of:

• title
• file path
• line number

Fields Mapped

The following fields are mapped from the Semgrep Pro JSON report:

Basic Information

• title: Mapped from rule_name
• severity: Mapped from Semgrep Pro severity levels (ERROR/HIGH → High, WARNING/MEDIUM → Medium, INFO/LOW → Low)
• file_path: Path to the affected file from location.file_path
• line: Line number from location.line
• unique_id_from_tool: Mapped from match_based_id

Status Fields

• active: Set to false if status is “fixed” or “removed”
• verified: Set to true if triage_state is not “untriaged”

Rich Content Fields

• description: Includes:
  • Rule message and details
  • CWE references
  • OWASP references
  • Categories
  • Triage information
• impact: Includes:
  • Vulnerability classes
  • Confidence level
  • Repository information
• mitigation: Includes:
  • Guidance summary
  • Detailed instructions
  • Auto-fix suggestions
  • Auto-triage information
  • Component details and risk level
• references: Includes:
  • Line of code URL
  • CWE references
  • OWASP references
  • External ticket information

Component Information

• component_name: Mapped from assistant.component.tag

Additional Fields

• static_finding: Always set to true
• dynamic_finding: Always set to false
• cwe: Extracted from first CWE reference if available
• date: Mapped from created_at