Classic scanner results in DefectDojo
Reading and exporting the classic scanners' findings in DefectDojo.
This page is about reading the classic scanners' results in DefectDojo. DefectDojo is optional, and recommended for the classic scanners: it receives every finding they report, visualises and tracks them, gathers statistics, creates reports and integrates with issue trackers. Which classic findings are also stored on ScanSuite's own Vulnerabilities page is set per team; see "Which findings are stored here" in Vulnerability Management.
The AI-driven scans do not export to DefectDojo at all: AI Native SAST, dependency reachability, AI DAST and AI Pentest findings are managed in ScanSuite's own Vulnerability Management, with full bug tracking. Secrets Detection and Dependency Check never export to DefectDojo either: secrets are reviewed on the Credentials page and dependency findings in the scan report. Hidden Paths results are held back by default given the nature of the data. Using DefectDojo means setting it up first — see Set up DefectDojo.
Opening the results
In ScanSuite, open the product from the Products page and click the DefectDojo · N pill under its name (N is the engagement). The DefectDojo line under a product in the list, and the status of a finished scan in Scan History, link to the same engagement. A product created without DefectDojo shows Local product instead and has no engagement.
You will be redirected to the DefectDojo instance. The first time, you will need to log in with the DefectDojo credentials — see Set up DefectDojo for how to retrieve them.
Once logged in, the Product → Engagement view opens directly from the ScanSuite reference, so you do not need to search for it inside DefectDojo:
Reading the findings
The engagement contains all successful scan exports, with the option to view a consolidated list of findings or the findings from each individual scan.
Click any finding for its details. These vary by scanner, but most provide the affected file and line number for static findings, the URL for dynamic ones, and further detail in the Description and Mitigation sections.
Exporting
Findings can be exported as HTML or CSV:
The HTML report presents all finding details in a scrollable form, which is often a better way to work through results than clicking each one individually.
Issue trackers
DefectDojo provides its own Jira integration for pushing findings into a remediation workflow. That is configured inside DefectDojo, not in ScanSuite. ScanSuite has no direct Jira connector, and the findings of the AI scans do not reach DefectDojo, so they do not reach Jira this way.
To learn more about DefectDojo's functionality, settings and troubleshooting, refer to the official documentation.
Last reviewed 2026-10-19