Monitoring DefectDojo with Vigilmon: Web UI, API Health, Celery Worker Checks & SSL Alerts

DefectDojo is the central aggregation point for your entire AppSec pipeline — ingesting scan results from Trivy, OWASP ZAP, Semgrep, Burp Suite, Snyk, Nessus, and 150+ other scanners, deduplicating findings, enforcing SLAs, and syncing with Jira. When DefectDojo goes down, CI/CD pipelines silently stop recording security scan results, vulnerability deduplication stops working, and your AppSec team loses visibility into the security posture of every service. When the Celery workers stall, Jira sync fails silently and report generation stops — while the web UI continues to look healthy. Vigilmon gives you external visibility into DefectDojo before your AppSec team notices: web application availability, API health, Celery worker status, and the full scanner ingestion pipeline.

What You'll Build

• A monitor on DefectDojo's login page to catch Django/Gunicorn failures
• A monitor on the DefectDojo REST API to verify authentication and API health
• A heartbeat monitor that verifies the full scan ingestion pipeline is operational
• SSL certificate monitoring for HTTPS DefectDojo deployments
• An alerting setup that catches both UI failures and silent Celery worker stalls

Prerequisites

• A running DefectDojo instance (Docker Compose or Kubernetes) accessible via HTTP or HTTPS
• A domain or IP pointing to DefectDojo (e.g., https://defectdojo.example.com)
• A DefectDojo API token (for API and pipeline health monitoring)
• A free account at vigilmon.online

Step 1: Verify DefectDojo's Health Endpoints

DefectDojo serves the Django web application via Gunicorn on port 8080 (HTTP) in Docker. A GET to / redirects to /login:

# Check web application availability
curl -I http://defectdojo.example.com:8080/

# Expect: HTTP 302 redirect to /login
# Or behind a reverse proxy:
curl -I https://defectdojo.example.com/login

The login page returns HTTP 200 when the Django/Gunicorn server is running and PostgreSQL is reachable. For API health, DefectDojo exposes a REST API at /api/v2/:

# Check API health (requires auth token)
curl -H "Authorization: Token YOUR_API_TOKEN" \
  https://defectdojo.example.com/api/v2/user/

# Returns current user details — confirms API is functional and auth is working

To get your API token: User Menu (top right) → API v2 Key in the DefectDojo web interface.

Step 2: Create a Vigilmon HTTP Monitor for the Login Page

The login page check confirms the Django/Gunicorn server is running and that PostgreSQL is accessible:

1. Log in to Vigilmon → Add Monitor → HTTP.
2. URL: https://defectdojo.example.com/login (or http://defectdojo.example.com:8080/login).
3. Check interval: 60 seconds.
4. Response timeout: 15 seconds.
5. Expected status: 200.
6. Keyword: DefectDojo (appears in the page title of the login form).
7. Click Save.

This monitor catches:

• Gunicorn process crashes or container restarts
• Django startup failures (missing environment variables, misconfigured settings)
• PostgreSQL connectivity failures (Django can't render the login page without a database connection)
• Docker Compose service outages after host restarts

Alert sensitivity: Set alerts to trigger after 2 consecutive failures. Django/Gunicorn deployments can occasionally return transient errors during container restarts or rolling updates.

Step 3: Create a Vigilmon HTTP Monitor for the API

The DefectDojo REST API powers all scanner integrations and CI/CD pipeline ingestion. Monitor it separately from the UI — the API can fail while the login page remains accessible:

1. Add Monitor → HTTP.
2. URL: https://defectdojo.example.com/api/v2/user/.
3. Check interval: 5 minutes.
4. Response timeout: 10 seconds.
5. Expected status: 200.
6. Custom header: Authorization: Token YOUR_API_TOKEN.
7. Keyword: username (appears in the JSON response with current user details).
8. Click Save.

No API token available? Monitor the login page for HTTP 200 with keyword Log In — both keywords (DefectDojo in the title and Log In in the button text) confirm the web layer is healthy without authentication.

Unauthenticated API check: A GET to /api/v2/ (the API root) returns HTTP 200 with the API documentation index even without authentication — this confirms the API router is functional, though it doesn't verify authentication is working.

Step 4: Set Up Heartbeat Monitoring for the Scanner Ingestion Pipeline

The most critical DefectDojo health signal is whether the full ingestion pipeline works — API receiving scans → Celery processing → PostgreSQL storing results. A stalled Celery worker means CI/CD scan results are silently not being recorded, even though the web UI looks healthy.

In Vigilmon:

1. Add Monitor → Heartbeat.
2. Name: DefectDojo scanner ingestion pipeline.
3. Expected interval: 25 hours (daily check with a 1-hour grace period).
4. Grace period: 60 minutes.
5. Copy the generated heartbeat URL.

In your CI/CD pipeline (add as a daily scheduled job):

#!/bin/bash
# Daily DefectDojo pipeline health check
# Submit a trivial empty Trivy scan to verify the full ingestion pipeline

DEFECTDOJO_URL="https://defectdojo.example.com"
API_TOKEN="YOUR_API_TOKEN"
ENGAGEMENT_ID="1"  # Use a dedicated "monitoring" engagement

# Create minimal empty Trivy JSON output
EMPTY_SCAN='{"Results": []}'

# POST to the import endpoint
RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" \
  -X POST "${DEFECTDOJO_URL}/api/v2/import-scan/" \
  -H "Authorization: Token ${API_TOKEN}" \
  -F "scan_type=Trivy Scan" \
  -F "engagement=${ENGAGEMENT_ID}" \
  -F "verified=false" \
  -F "active=true" \
  -F "file=@<(echo '${EMPTY_SCAN}')")

if [ "$RESPONSE" = "201" ]; then
  # Import successful — ping the heartbeat
  curl -fsS https://api.vigilmon.online/heartbeat/YOUR_HEARTBEAT_ID
else
  echo "DefectDojo import failed with status: $RESPONSE"
  exit 1
fi

A successful 201 response from the import endpoint confirms the full pipeline — REST API routing, Celery task queuing, and PostgreSQL write — is operational. A missed heartbeat means security scan results from CI are silently not being recorded.

Dedicated monitoring engagement: Create a separate DefectDojo engagement named "Vigilmon Health Monitoring" to keep health-check imports separate from real security scan data. Set the engagement to inactive so it doesn't affect your metrics.

Step 5: Monitor Celery Worker Health via the API

DefectDojo uses Celery for asynchronous task processing — deduplication, notification delivery, report generation, and Jira sync. A stalled Celery worker is the most common silent failure mode:

1. Add Monitor → HTTP.
2. URL: https://defectdojo.example.com/api/v2/system_settings/.
3. Check interval: 5 minutes.
4. Response timeout: 10 seconds.
5. Expected status: 200.
6. Custom header: Authorization: Token YOUR_API_TOKEN.
7. Keyword: enable_deduplication (appears in the system settings JSON — confirms the settings API is accessible).
8. Click Save.

Celery container check: If you have access to the DefectDojo host, docker compose ps | grep celery shows whether the Celery container is running. The system settings API is the best external proxy for Celery health available without shell access — if system settings are accessible, the Django layer talking to Celery is functional.

Step 6: Monitor SSL Certificates

DefectDojo handles sensitive vulnerability data from your entire codebase — HTTPS is not optional. When the certificate expires:

• All CI/CD scanner integrations making HTTPS API calls fail immediately
• Engineers can't access vulnerability findings (browser TLS error)
• Jira sync webhooks from DefectDojo may fail
• Scanner scan-result imports in CI pipelines begin failing with TLS errors

1. Add Monitor → SSL Certificate.
2. Domain: defectdojo.example.com.
3. Alert when expiry is within: 30 days.
4. Alert again: 14 days, 7 days, 3 days, 1 day.
5. Click Save.

Docker Compose + nginx: If DefectDojo runs behind the bundled nginx container in the official Docker Compose setup, verify the certificate is mounted correctly in the nginx container. Run docker exec defectdojo-nginx-1 nginx -t to confirm the nginx config is valid and the certificate path is correct.

Step 7: Configure Alerting

In Vigilmon under Settings → Notifications, configure your alert channels:

| Monitor | Trigger | Action | |---|---|---| | Login page | Non-200 or DefectDojo missing | Check docker compose ps; inspect docker compose logs defectdojo | | API (/api/v2/user/) | Non-200 or username missing | API or auth failure; check Django logs for exceptions | | System settings API | Non-200 | Celery/settings layer issue; check docker compose logs celery | | Scanner ingestion heartbeat | Heartbeat missed | Full pipeline check; test import manually; check Celery worker logs | | SSL certificate | < 30 days to expiry | Renew certificate; check nginx container mount |

Alert after: 2 consecutive failures for HTTP monitors. 1 missed heartbeat for the ingestion pipeline — a missed daily check means CI scan results may already be missing.

Common DefectDojo Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Gunicorn crash / container restart | Login page unreachable; alert within 60 s | | PostgreSQL connectivity failure | Login page returns 500; keyword check fails | | Celery worker stall | UI and API green; heartbeat missed; Jira sync stops | | API authentication failure | API monitor returns 401 instead of 200 | | Docker volume corruption | Login page may serve errors; imports fail | | SSL certificate expires | SSL monitor alerts at 30-day threshold; all CI integrations fail | | Django migration failure after upgrade | Login page returns 500; DB connection healthy but schema mismatch | | Memory exhaustion (OOM kill) | Login page unreachable after container restart | | Redis connectivity failure | Celery task queue stalls; imports appear to succeed but aren't processed |

DefectDojo's silent failure modes are the most dangerous ones: Celery worker stalls look like normal operation (the web UI works, the API accepts requests) while CI/CD scan results stop being processed. By the time your AppSec team notices that deduplication hasn't run or Jira tickets aren't being created, you may have days of unprocessed vulnerability data. Vigilmon's combination of login page monitoring, API health checks, and pipeline heartbeats catches all three failure modes — so you restore the full ingestion pipeline before any security findings go unrecorded.

Start monitoring DefectDojo in under 5 minutes — register free at vigilmon.online.