Draventis
Static analysis reads your code. Draventis tests what you actually deployed. OWASP ZAP and Nuclei run against your running targets on a schedule, and the findings land in DefectDojo.
a Magma Moose product · Apache-2.0 open source
Scan the running thing.
SAST, SCA, IaC scanning and secret detection all reason about source and artifacts at rest. None of them send a request to the deployed system. Draventis covers that half.
Tests what is deployed
Runtime response headers, TLS, cookie flags, CORS, session handling and injection that is reachable with a working payload. The behaviour, not the source.
ZAP and Nuclei do the scanning
Draventis is the orchestrator and uploader. OWASP ZAP, driven by its Automation Framework, plus Nuclei as an optional second engine.
On a schedule, in your cluster
Kubernetes CronJobs, nightly or weekly. DAST needs a running target, and your cluster already runs your apps.
A policy per target
baseline is passive and safe against production.
full is active and for staging only. api works
from an OpenAPI spec.
Reimport, not import
DefectDojo dedupes against the existing test, reactivates regressions and mitigates findings that have gone, so you get what is new and what is fixed without a merge-base.
An upload never fails a scan
The DefectDojo client is failure-isolated. If the sink is down, the error is logged and the scan result still stands.
Point it at your URLs. It does the rest.
Deploy the chart into any cluster, list your targets, and give it a DefectDojo URL. A CronJob runs each target on its policy and reimports the report.
defaults: policy: baseline # passive, safe against prod schedule: nightly defectdojo: url: https://defectdojo.example.com close_old_findings: true targets: - name: my-site url: https://my-site.example.com
Find it before someone else does.
Free and open source, Apache-2.0 licensed. Runs in your own cluster, against your own targets.