OWASP Flagship Projects: OWASP DefectDojo

### Overview In this presentation, maintainers Matt Tesauro and Aaron introduce OWASP DefectDojo, an open-source security orchestration and vulnerability management platform. Originally conceived eight to nine years prior within Rackspace by its product security team, DefectDojo was open-sourced and later designated an OWASP Flagship project. The speakers describe how security teams frequently resort to spreadsheets like Excel or Google Sheets to track findings—an approach that fails as vulnerability volumes grow. DefectDojo addresses this problem by serving as a central source of truth for application and product security findings, offering consolidated deduplication, integrations, tracking, and an extensive ingestion engine.

### Key Topics - **Origins and Purpose:** Built by application security practitioners to replace fragmented spreadsheets and disparate scanner web consoles with a centralized vulnerability repository and asset inventory. - **Ingestion and Deduping:** DefectDojo ingests reports from more than 100 security tools across DAST, SAST, IAST, container scanners, and cloud tools. It normalizes findings and deduplicates repeat issues to keep data manageable. - **Architecture and Modernization:** DefectDojo evolved from Python 2 and Django to Python 3 and Django 2, with efforts underway toward a React front end and API v2. Features from earlier internal tooling (such as the Bag of Holding metadata tool) were merged directly into DefectDojo. - **The AppSec Pipeline:** The speakers detail the conceptual workflow of application security programs—Intake, Triage, Testing, pushing findings into DefectDojo, and Delivery (integrating with Jira, Slack, MS Teams, and GRC systems). - **Deployment Options:** Deployments range from Docker Compose and Helm 3 on Kubernetes to Godojo, a single-binary installer for bare-metal/VM environments.

### Technical Details - **Parsing Engine:** Parsing outputs from over 100 tools is made straightforward through lightweight Python parsers (often 20–40 lines). A template generator repo assists community contributors in authoring new tool parsers, with sample outputs fed directly into automated unit testing. - **Integration and Automation:** The platform provides a Swagger-documented REST API (API v2) enabling automated ingestion in CI/CD pipelines. Supported notification and ticketing channels include Jira (with issue grouping to prevent ticket storms), Slack, and Microsoft Teams. It supports SSO via Okta, Google, Azure AD, and SAML, and incorporates standards like OWASP ASVS. - **Scalability and Deployments:** Demonstrated production setups include a single EC2 `t2.large` instance with AWS RDS running Docker Compose, as well as massive deployments with a 21 GB database handling 5,000 ingested findings per day using Celery for deduplication processing. Metal/VM deployments are supported via `godojo`, which offers over 160 configurable options that can be set through environment variables.

### Takeaways DefectDojo provides an automated, vendor-agnostic foundation for vulnerability management, freeing AppSec teams from manual tracking and enabling smaller teams to scale their assessment capacity significantly. The project relies heavily on an active open-source community, welcoming contributions in parser development, documentation, scanner test cases, and bug fixes. A public sandbox refreshed daily is maintained at demo.defectdojo.org.