DefectDojo now imports the Open Pentest Format natively

We built the Open Pentest Format so a finding library could move between tools instead of getting stuck in whichever one wrote it. That only counts for something if tools other than ours read it. As of this week, one does: DefectDojo 3.3.0 imports OPF natively.

Before this, getting a library into DefectDojo meant a translation step. Our opf-tools converter turned an OPF file into DefectDojo’s generic import format, and you loaded that. It worked, but it was a hop. In 3.3.0 the hop is gone. DefectDojo ships a native OPF parser: you upload the .opf.json into Import Scan, pick the OPF Scan type, and the findings land with their severity, CVSS, CWE and references intact.

importing an OPF library

# hand an OPF library straight to DefectDojo:
#   Import Scan  ->  scan type "OPF Scan"  ->  upload library.opf.json

# or build one from anything with opf-tools, then import it:
npx @cairnsec/opf-tools from-csv findings.csv > library.opf.json

Why this one matters

Cairn and opf-tools already read OPF, but those are ours. DefectDojo is a widely used platform we have no part in building or running, and its maintainers reviewed the OPF parser, merged it, and shipped it in their 3.3.0 release.

The point of OPF was always that a finding library should outlive the tool it was written in. This is the first time it has held up outside our own tools.

OPF is still deliberately small

This does not make OPF a standard, and it is not trying to be one. It is a version, a little metadata, and an array of findings, with description, impact and recommendation as separate fields and CVSS as a real value rather than a number buried in prose. It was only ever meant to let the write-ups a team builds up over years move somewhere else intact. DefectDojo is one more place they can go.