Package: Invicti AppSec Core (on-demand), Invicti AppSec Enterprise (on-premise, on-demand)
Import a tool report
You can import a vulnerability report generated by a supported security scanner into Invicti AppSec. Invicti AppSec automatically parses the file based on the scanner format.
Prerequisites
- You must have add permission on vulnerabilities.
Import a tool report
- Navigate to the project where you want to import vulnerabilities. You can do this in one of the following ways:
- Core: select Inventory > Targets from the left-side menu and click the project. Then click the Vulnerabilities tab.
- Core: select Inventory > Projects from the left-side menu and click the project. Then click the Vulnerabilities tab and select AppSec.
- Enterprise: select Projects and Products > Projects from the left-side menu and click the project. Then click the Vulnerabilities tab and select AppSec or Infra.
- Click the Actions dropdown in the upper-right corner and select Import.
- Select Tool as the import type.
- Fill in the following fields:
| Field | Description | Required |
|---|---|---|
| Scanner | The scanner tool that generated the report. | Yes |
| Branch | The branch to associate the imported data with. | Yes (except for Infrastructure scans) |
| Meta data | Additional metadata for the scan. Must be unique for the same branch and tool combination. | Required for Infrastructure and Nessus Pro scans |
| Scan tag | An optional tag for the imported scan. | No |
| Date discovered | The date the vulnerabilities were discovered. Can't be a future date. | Yes (except for Fortify) |
| File | The report file to import. Drag and drop or browse to select the file. | Yes |
- Click Import.
Supported scanners
Invicti AppSec supports importing reports from a wide range of security tools, including:
- Checkmarx (XML)
- Burp Suite (XML)
- WebInspect (XML)
- Nessus Pro (NES)
- Tenable.sc (XML)
- Rapid7 (XML)
- Fortify
- Trivy (JSON)
- OWASP ZAP (XML)
- CodeQL (SARIF)
- Semgrep (JSON/SARIF)
- JFrog Xray SCA
For the full list of supported scanners, check the Scanner dropdown on the import page.
View imported vulnerabilities
After importing, the vulnerabilities are added to the project and the import appears in the Imports tab. For more information, see Import vulnerabilities.
Imports are marked as manual and can't be rescanned. For more information, see Trigger a rescan.
Need help?
Invicti Support team is ready to provide you with technical help. Go to Help Center