# Trustwave

## File Types

Trustwave vulnerability scan reports can be exported/imported in CSV format.

### Total Fields in CSV: 13

Fields in order of appearance:

01. Status (Not mapped)  
02. IP - Used for endpoint host if Domain is empty  
03. Target Name (Not mapped)  
04. Domain - Primary choice for endpoint host  
05. Vulnerability Name - Maps to finding title  
06. Description - Maps to finding description  
07. Remediation - Maps to finding mitigation  
08. Protocol - Added to endpoint if present  
09. Port - Added to endpoint port if present, converted to integer  
10. Severity - Mapped through severity levels:  
    - I = Info  
    - L = Low  
    - M = Medium  
    - H = High  
    - C = Critical  
11. CVE - Added to vulnerability IDs list  
12. Service (Not mapped)  
13. Evidence - Maps to finding references

### Field Mapping Details

For each finding created, the parser:

- Creates endpoints by combining Domain/IP, Port, and Protocol fields  
- Sets default nb_occurrences to 1, incremented for duplicates  
- Uses SHA256 hash of severity + title + description for deduplication  
- Defaults severity to Low if mapping not matched

### Sample Scan Data

Sample Trustwave scans can be found in the [unit tests folder](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/trustwave).

### Link To Tool

[Trustwave](https://www.trustwave.com/en-us/) provides vulnerability scanning services through their SecureConnect platform.

### Default Deduplication Hashcode Fields

By default, DefectDojo identifies duplicate Findings using these [hashcode fields](https://docs.defectdojo.com/en/working_with_findings/finding_deduplication/about_deduplication/):

- title  
- cwe  
- line  
- file path  
- description