Categories

Static Application Security Testing (SAST)

Import Options

• API Connector (Pro)
• API Import
• UI Import
• Universal Importer (Pro)

File Types

• JSON

Integrations

Semgrep

Semgrep is a fast, open-source static analysis tool that performs static application security testing (SAST), software composition analysis (SCA), and secrets scanning across 30+ programming languages to identify security vulnerabilities, code quality issues, and insecure dependencies by using pattern-based rules that resemble actual source code rather than complex regex or abstract syntax trees. The platform integrates seamlessly into IDEs, CI/CD pipelines, and developer workflows with AI-powered analysis to reduce false positives by up to 98% through dataflow reachability analysis, providing automated remediation guidance, customizable security rules, and enforcement of secure coding standards throughout the software development lifecycle.

Semgrep Integration with DefectDojo

If your team runs Semgrep in CI, you're already generating structured SAST output on every push or pull request. Feeding those results into DefectDojo gives you a persistent, deduplicated record of findings across every repo and every scan — with the ability to track remediation status, assign findings to engineers, enforce SLA compliance, and report on code security posture over time. Without a platform like DefectDojo behind it, Semgrep findings live and die with the pipeline run that produced them.

Why Semgrep Matters

• Semgrep's rule language is readable and auditable — security teams can write and maintain custom rules without being compiler engineers, and findings map directly to patterns in the codebase rather than abstract heuristics.
• The Semgrep Registry provides a large library of community and Semgrep-maintained rules covering OWASP Top 10 patterns, framework-specific vulnerabilities, and secrets detection — giving teams immediate coverage without starting from scratch.
• Findings include file path, line number, matched code snippet, and rule metadata, making triage fast: developers can locate and understand the issue without leaving their editor.
• Semgrep supports output in JSON and SARIF formats, both of which DefectDojo can consume.
• Semgrep Pro and Semgrep Code extend analysis to cross-file and cross-function dataflow, surfacing taint-based vulnerabilities (SQL injection, XSS via user-controlled data) that single-file pattern matching would miss.
• It runs in seconds to minutes on most codebases, making it practical to run on every PR rather than as an infrequent batch scan.

Advantages of This Integration

• Deduplication across repos and branches: Related findings across products are surfaced as a pattern worth addressing at the framework or template level.
• Remediation tracking that survives pipeline runs: A finding's age persists across repo scans without resetting.
• SLA enforcement by severity: Semgrep severity maps to DefectDojo severity on import, allowing for SLA policy configuration.
• False positive handling without re-opening: Findings marked as false positives are recognized on re-imports.
• Cross-repo security posture reporting: A single view of open SAST findings across the entire portfolio.
• Developer-facing ticket workflow: Findings can be pushed to Jira or GitHub Issues with all necessary context included.

How This Integration Works

Semgrep produces JSON or SARIF output that DefectDojo's parsers consume directly. For most teams, the JSON format is the simpler path.

Step 1 — Run Semgrep and capture output

# Run with all configured rules and output JSON

semgrep --config auto --json --output semgrep-results.json.

# Run with a specific ruleset

semgrep --config p/owasp-top-ten --json --output semgrep-results.json.

# SARIF output (alternative format, also supported by DefectDojo)

semgrep --config auto --sarif --output semgrep-results.sarif.

Step 2 — Import into DefectDojo

Use Semgrep JSON Report as the scan type for JSON output, or SARIF for SARIF output:

curl -X POST https://<defectdojo-host>/api/v2/import-scan/ \
-H "Authorization: Token <your-api-token>" \
-F "scan_type=Semgrep JSON Report" \
-F "file=@semgrep-results.json" \
-F "engagement=<engagement-id>" \
-F "product=<product-id>" \
-F "active=true" \
-F "verified=false"

Step 3 — Reimport for ongoing CI scans

For repositories scanned on every PR, use the reimport endpoint to update existing findings:

curl -X POST https://<defectdojo-host>/api/v2/reimport-scan/ \
-H "Authorization: Token <your-api-token>" \
-F "scan_type=Semgrep JSON Report" \
-F "file=@semgrep-results.json" \
-F "test=<test-id>"

Data Granularity: What Gets Imported

Use Cases

In a pull request gate: Semgrep runs on every PR. Results import into a DefectDojo engagement scoped to that repository.

Across a monorepo with multiple services: A single Semgrep scan on a monorepo produces findings across dozens of services.

For a custom rule rollout: The security team writes Semgrep rules and aggregates results in DefectDojo to track progress.

During an audit or compliance review: DefectDojo provides an engagement history that aids in reporting for compliance purposes.

Operational Tips

• Use --config auto with care in large repos.
• Map one DefectDojo product per repository for clarity.
• Set INFO severity findings to inactive on import to focus the active queue.
• Use tags to track rule categories for better filtering.
• Build a shared false positive library to streamline documentation of common issues.
• Coordinate suppression between Semgrep and DefectDojo effectively.