##### Categories Static Application Security Testing (SAST) ##### Import Options - API Connector (Pro) - API Import - UI Import - Universal Importer (Pro) ##### File Types - JSON ##### Integrations # Semgrep [Semgrep](https://semgrep.dev/) is a fast, open-source static analysis tool that performs static application security testing (SAST), software composition analysis (SCA), and secrets scanning across 30+ programming languages to identify security vulnerabilities, code quality issues, and insecure dependencies by using pattern-based rules that resemble actual source code rather than complex regex or abstract syntax trees. The platform integrates seamlessly into IDEs, CI/CD pipelines, and developer workflows with AI-powered analysis to reduce false positives by up to 98% through dataflow reachability analysis, providing automated remediation guidance, customizable security rules, and enforcement of secure coding standards throughout the software development lifecycle. #### Semgrep Integration with DefectDojo If your team runs Semgrep in CI, you're already generating structured SAST output on every push or pull request. Feeding those results into DefectDojo gives you a persistent, deduplicated record of findings across every repo and every scan — with the ability to track remediation status, assign findings to engineers, enforce SLA compliance, and report on code security posture over time. Without a platform like DefectDojo behind it, Semgrep findings live and die with the pipeline run that produced them. #### Why Semgrep Matters - Semgrep's rule language is readable and auditable — security teams can write and maintain custom rules without being compiler engineers, and findings map directly to patterns in the codebase rather than abstract heuristics. - The Semgrep Registry provides a large library of community and Semgrep-maintained rules covering OWASP Top 10 patterns, framework-specific vulnerabilities, and secrets detection — giving teams immediate coverage without starting from scratch. - Findings include file path, line number, matched code snippet, and rule metadata, making triage fast: developers can locate and understand the issue without leaving their editor. - Semgrep supports output in JSON and SARIF formats, both of which DefectDojo can consume. - Semgrep Pro and Semgrep Code extend analysis to cross-file and cross-function dataflow, surfacing taint-based vulnerabilities (SQL injection, XSS via user-controlled data) that single-file pattern matching would miss. - It runs in seconds to minutes on most codebases, making it practical to run on every PR rather than as an infrequent batch scan. #### Advantages of This Integration - **Deduplication across repos and branches**: Related findings across products are surfaced as a pattern worth addressing at the framework or template level. - **Remediation tracking that survives pipeline runs**: A finding's age persists across repo scans without resetting. - **SLA enforcement by severity**: Semgrep severity maps to DefectDojo severity on import, allowing for SLA policy configuration. - **False positive handling without re-opening**: Findings marked as false positives are recognized on re-imports. - **Cross-repo security posture reporting**: A single view of open SAST findings across the entire portfolio. - **Developer-facing ticket workflow**: Findings can be pushed to Jira or GitHub Issues with all necessary context included. #### How This Integration Works Semgrep produces JSON or SARIF output that DefectDojo's parsers consume directly. For most teams, the JSON format is the simpler path. **Step 1 — Run Semgrep and capture output** \# Run with all configured rules and output JSON ``` semgrep --config auto --json --output semgrep-results.json. ``` \# Run with a specific ruleset ``` semgrep --config p/owasp-top-ten --json --output semgrep-results.json. ``` \# SARIF output (alternative format, also supported by DefectDojo) ``` semgrep --config auto --sarif --output semgrep-results.sarif. ``` **Step 2 — Import into DefectDojo** Use Semgrep JSON Report as the scan type for JSON output, or SARIF for SARIF output: ``` curl -X POST https:///api/v2/import-scan/ \ -H "Authorization: Token " \ -F "scan_type=Semgrep JSON Report" \ -F "file=@semgrep-results.json" \ -F "engagement=" \ -F "product=" \ -F "active=true" \ -F "verified=false" ``` **Step 3 — Reimport for ongoing CI scans** For repositories scanned on every PR, use the reimport endpoint to update existing findings: ``` curl -X POST https:///api/v2/reimport-scan/ \ -H "Authorization: Token " \ -F "scan_type=Semgrep JSON Report" \ -F "file=@semgrep-results.json" \ -F "test=" ``` #### Data Granularity: What Gets Imported | **Field** | **Source in Semgrep Output** | **Notes** | | --------- | ------------------------------ | --------- | | Title | check_id (rule ID) | e.g., python.django.security.injection.tainted-sql-string | | Severity | extra.severity | ERROR → High, WARNING → Medium, INFO → Low | | CWE ID | extra.metadata.cwe | Populated for rules that include CWE metadata | | OWASP Category | extra.metadata.owasp | Where rule metadata includes OWASP mapping | | Description | extra.message | Rule-specific finding message, often includes context | | File Path | path | Relative path to the affected file | | Line Number | start.line / end.line | Start and end line of the matched code | | Matched Code | extra.lines | The actual code snippet that triggered the rule | | Remediation | extra.metadata.fix | Fix guidance where included in rule metadata | | References | extra.metadata.references | Links to CVE, CWE, OWASP, or rule documentation | | Rule Source | extra.metadata.source | URL to the rule definition in Semgrep Registry | | Confidence | extra.metadata.confidence | HIGH, MEDIUM, LOW where rule provides it | | Language | Inferred from path extension | Used for filtering in DefectDojo | #### Use Cases **In a pull request gate**: Semgrep runs on every PR. Results import into a DefectDojo engagement scoped to that repository. **Across a monorepo with multiple services**: A single Semgrep scan on a monorepo produces findings across dozens of services. **For a custom rule rollout**: The security team writes Semgrep rules and aggregates results in DefectDojo to track progress. **During an audit or compliance review**: DefectDojo provides an engagement history that aids in reporting for compliance purposes. #### Operational Tips - Use **--config auto** with care in large repos. - Map one DefectDojo product per repository for clarity. - Set INFO severity findings to inactive on import to focus the active queue. - Use tags to track rule categories for better filtering. - Build a shared false positive library to streamline documentation of common issues. - Coordinate suppression between Semgrep and DefectDojo effectively.