Fetching High/Critical Vulnerabilities via DefectDojo API

[gmartg]

Hi everyone,

We’re evaluating DefectDojo for a large enterprise and we need to fetch high and critical vulnerabilities by product, including CWE and CVE details, using the DefectDojo API. We've tried the products, engagements, and findings endpoints but haven't succeeded. Could anyone advise on how to correctly pull this data?

[manuel-sommer]

Hi @gmartg,

did you checkout https://defectdojo.github.io/django-DefectDojo/usage/models/ ?
Basically, you can use the REST API for that:

1. get the product
2. get the engagements from the product and the engagement should you return you a list of findingids assigned to the engagement.
3. With that, you can return each finding from the product.

If you want to get started easier, you can take a look at https://pypi.org/project/defectdojo_api/ (This is already deprecated / archived, but gives you a good introduction / help).

Here, you can also find more information: https://documentation.defectdojo.com/integrations/api-v2-docs/

If you can't implement it on your own, you can also ask for support: https://www.defectdojo.com/pricing.

[manuel-sommer]

@gmartg or @mtesauro, could you mark my above answer as the answer?