Excluding Security Hotspots During SonarQube API Vulnerability Import into Defect Dojo

[sametr35]

Hello,

I've been able to exclude bugs and code smells when importing SonarQube vulnerabilities with API into Defect Dojo, which is great. However, I'm encountering difficulty in excluding security hotspots. Is there a way to exclude them as well? Thank you for your assistance.

[dsever]

Have you followed the instructions https://defectdojo.github.io/django-DefectDojo/integrations/parsers/api/sonarqube/ ?

[sametr35]

Yes, In the documentation. I could not see anything about security hotspot exclusion.

[dsever]

Yes, In the documentation. I could not see anything about security hotspot exclusion.

I have to dive into the code, I was implementing it 2 year ago :)

[KarthikY18]

Any Update on this?

[sametr35]

Hi @KarthikY18, Security Hotspots are generally of low severity. When importing issues please choose minimum severity=medium, Security Hotspots will not be included. If you need to include low severity issues, there is currently no solution for that. You will see security hotspots.

[KarthikY18]

Thank you @sametr35, this helps me.