pload your third party tool scan results and all the findings will be imported automatically.

DefectDojo accepts:

Acunetix Scanner - XML format.
Anchore-Engine - Anchore-CLI JSON vulnerability report format.
AWS Scout2 Scanner - JS file in scout2-report/inc-awsconfig/aws_config.js.
AWS Prowler Scanner - Prowler file can be imported as a CSV file (-M csv).
Arachni Scanner - Arachni JSON report format.
AppSpider (Rapid7) - Use the VulnerabilitiesSummary.xml file found in the zipped report download.
Bandit - JSON report format
Blackduck Hub - CSV report format (security.csv)
Bundler-Audit Scan - 'bundler-audit check' output (in plain text)
Burp XML - When the Burp report is generated, the recommended option is Base64 encoding both the request and response fields. These fields will be processed and made available in the 'Finding View' page.
Brakeman Scan - Import Brakeman Scanner findings in JSON format.
Clair Scan - Import JSON reports of Docker image vulnerabilities.
Clair Klar Scan - Import JSON reports of Docker image vulnerabilities from clair klar client.
Contrast Scanner - CSV Report
Checkmarx Detailed XML Report
Cobalt.io Scan - CSV Report
Crashtest Security JUnit XML Report
DawnScanner - Dawnscanner (-j) output file can be imported in JSON format.
Dependency Check - OWASP Dependency Check output can be imported in Xml format.
Generic Findings Import - Import Generic findings in CSV format.
Gosec Scanner - Import Gosec Scanner findings in JSON format.
Kiuwan Scanner - Import Kiuwan Scan in CSV format. Export as CSV Results on Kiuwan.
MobSF Scanner - Export a JSON file using the API, api/v1/report_json.
Mozilla Observatory Scanner- Import JSON report.
Nessus (Tenable) - Reports can be imported as CSV or .nessus (XML) report formats.
Netsparker Scanner - Netsparker JSON format.
Nexpose XML 2.0 (Rapid7) - Use the full XML export template from Nexpose.
Nikto - XML output
Nmap - XML output (use -oX)
Node Security Platform - Node Security Platform (NSP) output file can be imported in JSON format.
NPM Audit - NPM Audit Scan output file can be imported in JSON format.
Openscap Vulnerability Scan - Import Openscap Vulnerability Scan in XML formats.
OpenVAS CSV - Import OpenVAS Scan in CSV format. Export as CSV Results on OpenVAS.
PHP Security Audit v2 - Import PHP Security Audit v2 Scan in JSON format.
PHP Symfony Check - Import results from the PHP Symfony Security Checker by Sensioslabs.
Qualys - Qualys output files can be imported in XML format.
Qualys WebScan - Qualys WebScan output files can be imported in XML format.
Retire.js - Retire.js JavaScript scan (--js) output file can be imported in JSON format.
Safety Scan - Safety scan (--json) output file can be imported in JSON format.
SKF Scan - Output of SKF Sprint summary export.
Snyk - Snyk output file (snyk test --json > snyk.json) can be imported in JSON format.
Sonatype Application Scan - Can be imported in JSON format
SpotBugs - XML report of textui cli.
SSL Labs - JSON Output of ssllabs-scan cli.
Trufflehog - JSON Output of Trufflehog.
Trustwave - CSV output of Trustwave vulnerability scan.
Twistlock image scan - JSON output of twistcli image scan.
Visual Code Grepper (VCG) - VCG output can be imported in CSV or Xml formats.
Veracode Detailed XML Report
Wapiti Scan - Import XML report.
Immuniweb Scan - XML Scan Result File from Imuniweb Scan.
Zed Attack Proxy - ZAP XML report format.