stingray-defectdojo

Stingray scan result to DefectDojo importer

A small python tool for exporting Stingray scan result to DefectDojo generic findings json format and then importing it to your DefectDojo project as findings import.

Demo in russian: https://www.youtube.com/watch?v=G5DTlYcpO0Y

Launch parameters

Required parameters:
Stingray:

• --login - Stingray login
• --password - Stingray password (can also be set via the STINGRAY_PASSWORD environment variable, so the secret does not end up in the shell history)
• --url - network address for system (System url, should be with /rest, example: https://saas.stingray.ru/rest)
• --scan_id - identifier of the scan to be exported

Defect Dojo:

• --dojo_url - Url to DefectDojo server
• --dojo_key - DefectDojo api v2 key (can also be set via the DOJO_API_KEY environment variable)
• --engagement_id - DefectDojo engagement id (one project in stingray - one engagement in dojo)

Optional parameters:

• --file_name - custom name for json file to be saved locally, default: stingray_scan, file name will be stingray_scan_{scan_id}_defectDojo_format.json
• --dojo_environment - DefectDojo environment for importing results. Default: ''
  Choices: Default/Development/Lab/Pre-prod/Production/Staging/Test
• --dojo_min_severity - DefectDojo minimal severity. Default: 'Info'
  Choices: Info/Low/Medium/High/Critical

Launch

Before first launch ypu should install pip packages:

pip install -r requirements.txt

Simple launch example:

python3 stingray-defectdojo/import_scan.py -u https://saas.stingray/rest -l admin -p P@ssw0rd -id 1337 --file_name buggen --dojo_url https://dojo.com --dojo_key D0j0S3cr3t --engagement_id 1 -env Staging

The script exits with a non-zero code on any failure (scan not found, no access, DefectDojo rejected the import), so it can be used as a CI/CD pipeline step.

Compatibility notes

• Works with any Stingray version. Reports of Stingray 2025.5+ contain the defect id and CWE directly; on older versions the script resolves the defect ids through one extra bulk API call per scan.
• vuln_id_from_tool is always the project issue id: the same STG-... number you see in the Stingray UI. A defect whose id cannot be resolved is skipped with a warning rather than exported with an id from a wrong namespace.
• Defects that fail to parse are skipped with a warning instead of aborting the whole import; the log reports how many were skipped. If every defect fails to parse, the script aborts with a non-zero exit code instead of importing an empty result (an empty import could wrongly close existing DefectDojo findings).
• Only the first occurrence of each defect goes to the finding description (a defect found in many places is still one finding).
• TLS certificate verification is disabled for both Stingray and DefectDojo requests (self-signed certificates are common for on-premise installations). Do not run the script through untrusted networks.