# Vulnerability Analysis

At the end of the DevSecOps Pipeline we want to gather all the results and analyze them.&#x20;

## Defect Dojo Open Source

DefectDojo is an open-source vulnerability management tool build by security engineers and OWASP. It is available as a docker image [https://github.com/DefectDojo/django-DefectDojo](https://github.com/DefectDojo/django-DefectDojo).

I install it on the same server as where my gitlab is running. Think of changing the ports when running it.

## Farady

Another free vulnerability management tool is Farady [https://faradaysec.com/](https://faradaysec.com/)

## Integration into the CD/CI pipeline

After each script execution we want to upload the scan results to out vulnerability analysis tool. Defect Dojo supports many scanners, documentation is available here [https://defectdojo.github.io/django-DefectDojo/integrations/import/](https://defectdojo.github.io/django-DefectDojo/integrations/import/)&#x20;

