From 9ce2cd288f866678baa18c05c348f719df3586c6 Mon Sep 17 00:00:00 2001 From: Greg Anderson Date: Wed, 22 Jul 2026 21:28:17 -0600 Subject: [PATCH] docs(connectors): Socket.dev connector reference Document the Socket connector: the org API-token prerequisite, the Location/Secret/Minimum-Severity mappings, and the whole-account model (repository -> Record; each full-scan alert -> finding, severity, package+PURL, category tags, static, dedupe on alert key). Companion to connectors#759 and dojo-pro#2009. sc-13907 Co-Authored-By: Claude Opus 4.8 --- .../connectors/connectors_tool_reference.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/docs/content/import_data/pro/connectors/connectors_tool_reference.md b/docs/content/import_data/pro/connectors/connectors_tool_reference.md index 1ba6cb02969..7d0cf42583b 100644 --- a/docs/content/import_data/pro/connectors/connectors_tool_reference.md +++ b/docs/content/import_data/pro/connectors/connectors_tool_reference.md @@ -876,6 +876,24 @@ The Snyk connector uses the Snyk REST API to fetch data. See the [Snyk API documentation](https://docs.snyk.io/snyk-api) for more info. +## **Socket** + +The Socket connector uses the [Socket.dev](https://socket.dev) API to import **software supply-chain findings** — Socket's alerts on your dependencies (malware, typosquats, install scripts, known vulnerabilities and 70+ other categories). DefectDojo discovers every repository across the organizations your token can access and creates a Record for each, then imports the alerts from that repository's latest full scan. + +#### Prerequisites + +You will need a Socket **API token** — an organization token created in the Socket dashboard under **Settings → API Tokens** (with the `repo:list` and full-scan read scopes). The token is sent as a bearer token and is never logged. + +#### Connector Mappings + +1. Leave the **Location** field blank to use `https://api.socket.dev/v0`, or enter it explicitly. +2. Enter the Socket API token in the **Secret** field. +3. Optionally, set a **Minimum Severity** to limit which findings are imported. + +DefectDojo maps each **repository** to a Record and imports the alerts from its most recent full scan. Each alert becomes a finding: the severity comes from Socket's own rating (low, medium, high, critical), the affected package becomes the component and a PURL, the alert category (supply-chain risk, quality, maintenance, vulnerability, license) is recorded as tags, and the alert details are carried into the description. Findings are recorded as static findings and de-duplicated on Socket's alert key. + +See the [Socket API documentation](https://docs.socket.dev/reference) for more information. + ## Tenable The Tenable connector uses the **Tenable.io** REST API to fetch data. Scans are pulled from the Tenable VM `/scans` endpoint.