Skip to content

docs(connectors): Deepfence ThreatMapper connector reference #15337

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
devGregA wants to merge 1 commit into
base: bugfix
Choose a base branch
from
Draft

docs(connectors): Deepfence ThreatMapper connector reference #15337

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions docs/content/import_data/pro/connectors/connectors_tool_reference.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,6 +338,25 @@ A Falcon **API client** (Client ID and secret), created in the Falcon console un

Each Falcon host becomes a Record, named for its hostname, OS, and type. Only **open** and **reopened** Spotlight vulnerabilities are imported, so reimport closes remediated findings.

## **Deepfence ThreatMapper**

The Deepfence ThreatMapper connector uses the [ThreatMapper](https://github.com/deepfence/ThreatMapper) management-console REST API to import **vulnerability scan** results. DefectDojo discovers every node ThreatMapper has scanned — a container image, host, or container — and creates a Record for each, then imports that node's most recent completed scan as findings.

#### Prerequisites

You will need a ThreatMapper **API token**, found in the console under **Settings → User Management** (your user's API key). The connector exchanges it for a short-lived access token on each sync; the API token is never logged.

#### Connector Mappings

1. Enter your ThreatMapper console URL in the **Location** field (for example `https://threatmapper.example.com`).
2. In the **Secret** field, enter the ThreatMapper API token.
3. If your console uses a self-signed certificate, set **Skip TLS Verification** to `true`.
4. Optionally, set a **Minimum Severity** to limit which findings are imported.

DefectDojo maps each scanned **node** to a Record and each **CVE** in its latest completed vulnerability scan to a finding. The severity comes from ThreatMapper's own rating, and the affected package, CVSS score, fix version (as mitigation), reference links, and a details block are carried over. Findings are recorded as dynamic findings and de-duplicated on the node, CVE, package and package path.

See the [ThreatMapper documentation](https://community.deepfence.io/threatmapper/docs/v2.5/) for more information.

## Dependency\-Track

This connector fetches data from a on\-premise Dependency\-Track instance, via REST API.
Expand Down
Loading