security-automation

Add dedicated pipeline stages running Semgrep for SAST, Trivy for dependency and container scanning, and ZAP or Nuclei for DAST, exporting JSON results as artifacts. Enforce quality gates by failing the build on CRITICAL or HIGH severity findings, for example with trivy --exit-code 1 --severity CRITICAL,HIGH.

Use Trivy or Grype for container image and dependency scanning, Checkov or tfsec for Terraform, and kube-bench for Kubernetes CIS benchmarks. For policy enforcement, OPA/Gatekeeper or Kyverno provide admission control, while Conftest tests arbitrary configuration files.

Apply a three-layer pipeline: deterministic rules filter 90-95% of benign events, then an LLM triages enriched alerts with structured output including severity, disposition, and confidence scores. Source-specific triage agents with confidence thresholds outperform a single general-purpose agent, cutting escalation rates to around 3%.

Yes, scan outputs from Trivy, Semgrep, Nuclei, and ZAP can be posted to the DefectDojo import-scan API endpoint with the appropriate scan_type parameter. Results are normalized, deduplicated by CWE/CVE and asset fingerprints, and tracked through SLA-based remediation workflows.

Agents must run under least-privilege service accounts with action whitelists, human-in-the-loop approval for high-impact actions like host isolation, and full audit logging of reasoning and tool calls. Prefer reversible actions, validate findings with exploit proof-of-concepts, and sanitize tool inputs against prompt injection.

Use deterministic SOAR playbooks for high-frequency, well-understood scenarios like brute-force investigation where steps are predictable. Reserve LLM agents for novel or ambiguous alerts requiring dynamic investigation, always within rule boundaries, action whitelists, and approval gates.