Feature/lab10

[fayz131]

Goal

Implement vulnerability management workflow using DefectDojo by importing scan results from multiple security tools (Semgrep, Trivy, Grype) and generating consolidated reports.

Changes

• Deployed DefectDojo locally using Docker Compose
• Configured API access and created:
  • Product Type (Engineering)
  • Product (Juice Shop)
  • Engagement (Labs Security Testing)
• Imported scan results:
  • Semgrep (successful, 5 findings)
  • Anchore Grype (successful, 167 findings)
  • Trivy (attempted, failed with internal error)
• Generated reports:
  • PDF report (dojo-report.pdf)
  • Findings export (findings.csv)
  • Metrics snapshot (metrics-snapshot.md)
• Added submission report (submission10.md)

Testing

• Verified DefectDojo is available on http://localhost:8080

• Check API:
  curl -H "Authorization: Token $DD_TOKEN" $DD_API/test_types/

• Startes import:
  bash labs/lab10/imports/run-imports.sh

• Checked results in UI:

  • Findings (179 total)
  • Severity breakdown correct

• Checked files:
  ls labs/lab10/report

Artifacts & Screenshots

• labs/lab10/report/dojo-report.pdf
• labs/lab10/report/findings.csv
• labs/lab10/report/metrics-snapshot.md
• Screen DefectDojo with findings (179 total)

---

Checklist

• PR title is clear and descriptive
• Documentation updated if needed
• No secrets, temporary files, or large binaries included