OWASP DefectDojo Vulnerability SLA Escalation Sentinel

id: defectdojo-vulnerability-sla-escalation-sentinel
namespace: company.team

description: |
  Audits OWASP DefectDojo for unmitigated verified critical and high vulnerabilities, validates resolution SLA thresholds, classifies organizational security posture, and routes escalation alerts to Slack.

triggers:
  - id: every_morning_weekday
    type: io.kestra.plugin.core.trigger.Schedule
    description: Executes automated DefectDojo vulnerability SLA audits at 08:00 AM
      every weekday.
    cron: "0 8 * * 1-5"
    disabled: true
    inputs:
      defectdojo_host: "defectdojo"
      defectdojo_port: 8080
      max_tolerated_critical_findings: 0
      max_tolerated_high_findings: 5

inputs:
  - id: defectdojo_host
    type: STRING
    displayName: DefectDojo Hostname
    description: Hostname or IP address of the DefectDojo instance reachable by the
      Kestra worker.
    defaults: "defectdojo"

  - id: defectdojo_port
    type: INT
    displayName: DefectDojo HTTP Port
    description: HTTP port of the DefectDojo API service (defaults to 8080).
    defaults: 8080

  - id: max_tolerated_critical_findings
    type: INT
    displayName: Max Tolerated Critical Findings
    description: Maximum allowable verified unmitigated Critical findings before
      triggering an SLA breach escalation alert.
    defaults: 0

  - id: max_tolerated_high_findings
    type: INT
    displayName: Max Tolerated High Findings
    description: Maximum allowable verified unmitigated High findings before
      triggering a warning notification.
    defaults: 5

tasks:
  - id: probe_products
    type: io.kestra.plugin.core.http.Request
    description: Queries the DefectDojo products API to verify endpoint availability
      and active product catalog tracking.
    uri: "http://{{ inputs.defectdojo_host }}:{{ inputs.defectdojo_port
      }}/api/v2/products/?limit=10"
    method: GET
    headers:
      Authorization: "Token {{ secret('DEFECTDOJO_API_KEY') }}"
      Accept: "application/json"
    options:
      allowFailed: true
    allowFailure: true

  - id: probe_critical_findings
    type: io.kestra.plugin.core.http.Request
    description: Queries unmitigated verified Critical severity findings to check
      for active vulnerability SLA violations.
    uri: "http://{{ inputs.defectdojo_host }}:{{ inputs.defectdojo_port
      }}/api/v2/findings/?active=true&verified=true&duplicate=false&is_mitigate\
      d=false&severity=Critical&limit=50"
    method: GET
    headers:
      Authorization: "Token {{ secret('DEFECTDOJO_API_KEY') }}"
      Accept: "application/json"
    options:
      allowFailed: true
    allowFailure: true

  - id: probe_high_findings
    type: io.kestra.plugin.core.http.Request
    description: Queries unmitigated verified High severity findings to inspect
      secondary vulnerability SLA thresholds.
    uri: "http://{{ inputs.defectdojo_host }}:{{ inputs.defectdojo_port
      }}/api/v2/findings/?active=true&verified=true&duplicate=false&is_mitigate\
      d=false&severity=High&limit=50"
    method: GET
    headers:
      Authorization: "Token {{ secret('DEFECTDOJO_API_KEY') }}"
      Accept: "application/json"
    options:
      allowFailed: true
    allowFailure: true

  - id: classify_sla_status
    type: io.kestra.plugin.core.debug.Return
    description: Evaluates API response codes and finding counts against SLA
      thresholds to classify security posture into COMPLIANT,
      HIGH_SEVERITY_WARNING, CRITICAL_SLA_BREACH, PROBE_FAILED, or
      API_UNREACHABLE.
    format: |
      {{ (outputs.probe_products.code is not defined or outputs.probe_products.code != 200) ? 'API_UNREACHABLE' : ( (outputs.probe_critical_findings.code is not defined or outputs.probe_critical_findings.code != 200 or outputs.probe_high_findings.code is not defined or outputs.probe_high_findings.code != 200) ? 'PROBE_FAILED' : ( ((outputs.probe_critical_findings.body | json | jq('.count') | first) > inputs.max_tolerated_critical_findings) ? 'CRITICAL_SLA_BREACH' : ( ((outputs.probe_high_findings.body | json | jq('.count') | first) > inputs.max_tolerated_high_findings) ? 'HIGH_SEVERITY_WARNING' : 'COMPLIANT' ) ) ) }}

  - id: route_by_sla_status
    type: io.kestra.plugin.core.flow.Switch
    description: Routes workflow notifications based on the classified vulnerability
      SLA status.
    value: "{{ outputs.classify_sla_status.value }}"
    cases:
      "COMPLIANT":
        - id: log_compliant_state
          type: io.kestra.plugin.core.log.Log
          message: "DefectDojo SLA status is COMPLIANT. Products tracked: {{
            outputs.probe_products.body | json | jq('.count') | first }}. Active
            Critical findings: {{ outputs.probe_critical_findings.body | json |
            jq('.count') | first }}. Active High findings: {{
            outputs.probe_high_findings.body | json | jq('.count') | first }}."

      "HIGH_SEVERITY_WARNING":
        - id: alert_high_warning_slack
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK') }}"
          payload: |
            {{ {"text": "DefectDojo Sentinel WARNING on " ~ inputs.defectdojo_host ~ ":" ~ inputs.defectdojo_port ~ ". Found " ~ (outputs.probe_high_findings.body | json | jq('.count') | first) ~ " active High severity findings (exceeds threshold of " ~ inputs.max_tolerated_high_findings ~ "). Sample findings: " ~ (outputs.probe_high_findings.body | json | jq('[.results[:3][] | \"#\" + (.id | tostring) + \" \" + .title + \" (\" + (.cve // \"NO-CVE\") + \")\"] | join(\", \")') | first) ~ ". Execution: " ~ execution.id ~ "."} | toJson }}

        - id: log_high_warning
          type: io.kestra.plugin.core.log.Log
          message: "High severity finding count warning: {{
            outputs.probe_high_findings.body | json | jq('.count') | first }}
            findings exceed threshold of {{ inputs.max_tolerated_high_findings
            }}."

      "CRITICAL_SLA_BREACH":
        - id: alert_critical_breach_slack
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK') }}"
          payload: |
            {{ {"text": "DefectDojo Sentinel CRITICAL SLA BREACH on " ~ inputs.defectdojo_host ~ ":" ~ inputs.defectdojo_port ~ ". Found " ~ (outputs.probe_critical_findings.body | json | jq('.count') | first) ~ " active Critical severity findings (exceeds threshold of " ~ inputs.max_tolerated_critical_findings ~ "). Affected findings: " ~ (outputs.probe_critical_findings.body | json | jq('[.results[:5][] | \"#\" + (.id | tostring) + \" \" + .title + \" (\" + (.cve // \"NO-CVE\") + \")\"] | join(\", \")') | first) ~ ". Immediate remediation required. Execution: " ~ execution.id ~ "."} | toJson }}

      "PROBE_FAILED":
        - id: alert_probe_failed_slack
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK') }}"
          payload: |
            {{ {"text": "DefectDojo Sentinel PROBE_FAILED on " ~ inputs.defectdojo_host ~ ":" ~ inputs.defectdojo_port ~ ". Products endpoint responded but findings query failed. Check DEFECTDOJO_API_KEY permissions. Execution: " ~ execution.id ~ "."} | toJson }}

      "API_UNREACHABLE":
        - id: alert_unreachable_slack
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK') }}"
          payload: |
            {{ {"text": "DefectDojo Sentinel API_UNREACHABLE. Cannot reach DefectDojo at http://" ~ inputs.defectdojo_host ~ ":" ~ inputs.defectdojo_port ~ "/api/v2/products/. Service is offline or network partitioned. Execution: " ~ execution.id ~ "."} | toJson }}

  - id: log_audit_summary
    type: io.kestra.plugin.core.output.OutputValues
    description: Exports structured telemetry attributes and finding counts for
      compliance reporting.
    values:
      sla_status: "{{ outputs.classify_sla_status.value }}"
      total_products: "{{ outputs.probe_products.body | json | jq('.count') | first ?? 0 }}"
      critical_findings_count: "{{ outputs.probe_critical_findings.body | json |
        jq('.count') | first ?? 0 }}"
      high_findings_count: "{{ outputs.probe_high_findings.body | json | jq('.count')
        | first ?? 0 }}"
      max_tolerated_critical: "{{ inputs.max_tolerated_critical_findings }}"
      max_tolerated_high: "{{ inputs.max_tolerated_high_findings }}"

errors:
  - id: alert_flow_error
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Sends an alert notification if an unexpected exception halts
      sentinel execution.
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {{ {"text": "DefectDojo Sentinel workflow error during execution " ~ execution.id ~ " in namespace " ~ flow.namespace ~ "."} | toJson }}

Continuously audits OWASP DefectDojo vulnerability management platforms by querying REST API v2 endpoints, validating active verified findings against SLA resolution deadlines, classifying organizational posture, and routing escalation alerts to Slack.

How it works

probe_products queries /api/v2/products/ using an API token to verify DefectDojo service health and active product tracking.
probe_critical_findings queries /api/v2/findings/ filtered for active=true, verified=true, is_mitigated=false, and severity=Critical.
probe_high_findings queries /api/v2/findings/ with identical filters for severity=High.
classify_sla_status evaluates finding counts against configurable SLA thresholds using a Pebble conditional expression:
- Classifies state as CRITICAL_SLA_BREACH when active Critical findings exceed max_tolerated_critical_findings.
- Classifies state as HIGH_SEVERITY_WARNING when High findings exceed max_tolerated_high_findings.
- Classifies state as COMPLIANT when all findings remain within allowable limits.
- Identifies unreachable endpoints as API_UNREACHABLE or PROBE_FAILED.
route_by_sla_status branches workflow execution based on the classification:
- COMPLIANT: Logs compliant posture, tracked product counts, and current finding metrics.
- HIGH_SEVERITY_WARNING: Dispatches a Slack alert with finding IDs, titles, and CVE identifiers exceeding the high-severity threshold.
- CRITICAL_SLA_BREACH: Posts an urgent escalation alert to Slack naming exact Critical finding titles and CVEs requiring immediate patching.
- API_UNREACHABLE / PROBE_FAILED: Notifies on-call teams of API communication failures.
log_audit_summary exports structured metrics capturing SLA classifications and finding counts for compliance verification.
errors catches unhandled exceptions and posts a high-priority incident notice to Slack.

What you get

Automated, scheduled auditing of application security vulnerability backlogs without manual dashboard reviews.
Immediate escalation of overdue Critical and High CVEs before regulatory or SLA deadlines are breached.
Contextual Slack alerts containing exact finding IDs, vulnerability titles, and associated CVE numbers.
Centralized audit records tracking compliance metrics over time for SOC2, ISO27001, and FedRAMP audits.
Automated weekday scheduling with full support for on-demand CI/CD pipeline triggers.

Who it's for

DevSecOps Engineers and Security Champions tracking remediation velocity across development teams.
Security Operations (SecOps) teams enforcing vulnerability management SLAs and policy gates.
Platform and Engineering Leads requiring automated visibility into open security liabilities.

Why orchestrate this with Kestra

Vulnerability backlogs in tools like DefectDojo grow continuously from daily automated scanner runs. Without active orchestration, critical findings slip past SLA deadlines unnoticed until an audit or incident occurs. Kestra provides declarative, reliable orchestration with unified secret management, robust HTTP probing, automated scheduling, and multi-channel incident alerting.

Prerequisites

A running OWASP DefectDojo instance with REST API v2 accessible from the Kestra worker.
A DefectDojo API key generated under User Profile > API v2 Key.
An incoming Slack webhook URL for alert delivery.

Secrets

DEFECTDOJO_API_KEY: DefectDojo user API token used for HTTP Token authentication.
SLACK_WEBHOOK: Incoming Slack webhook URL used by alert_high_warning_slack, alert_critical_breach_slack, alert_probe_failed_slack, alert_unreachable_slack, and the errors handler.

Quick start

Generate an API v2 key in DefectDojo and add DEFECTDOJO_API_KEY and SLACK_WEBHOOK as secrets in your Kestra namespace.

Start a local DefectDojo instance using Docker Compose:

git clone https://github.com/DefectDojo/django-DefectDojo && cd django-DefectDojo
./dc-build.sh && ./dc-up.sh

Execute this flow manually in Kestra setting defectdojo_host: "localhost" or "defectdojo".
The workflow queries finding counts, evaluates thresholds, classifies COMPLIANT, and logs audit metrics.
Enable the every_morning_weekday trigger to automate daily morning SLA monitoring.

How to extend

Filter findings by specific product tags or engagement IDs using additional query parameters like tags=production.
Automatically create Jira or GitHub issues for overdue findings using dedicated Kestra issue tracker plugins.
Integrate with PagerDuty for Critical SLA breaches requiring immediate on-call pageouts.
Add automated test re-import tasks to trigger fresh scanner ingestion prior to running the SLA evaluation.

OWASP DefectDojo Vulnerability SLA Escalation Sentinel

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

OWASP DefectDojo Vulnerability SLA Escalation Sentinel

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Infrastructure Blueprints

ADLS World-Writable ACL Sentinel

ACM Certificate Expiry Compliance Sentinel

Environmental Disaster Early Warning System

Aerospike Stop-Writes Headroom Sentinel

AI Incident Post-Mortem and Root Cause Generator

Renew TLS certificates through ACME, verify them, deploy them and roll back on failure

New to Kestra?