Black Duck Coverity (SOAP)
Application Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Coverity connector integrates with Black Duck Coverity (formerly Synopsys Coverity), a static application security testing (SAST) platform, via its WSDL-based SOAP web services (DefectService and ConfigurationService over JAX-WS). It synchronizes code projects, static-code defects, and defect-type definitions into the Brinqa platform.
Data retrieved from Black Duck Coverity (SOAP)
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Project | Yes | Code Project |
| Defect | Yes | Static Code Finding |
| Defect Type | Yes | Static Code Finding Definition |
Model relationships
For detailed steps on how to view the data retrieved from Black Duck Coverity (SOAP) in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Black Duck Coverity (SOAP) from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Server URL | Yes | https://<server_name> | Black Duck Coverity server URL |
| Username | Yes | — | Black Duck Coverity username |
| Password | Yes | — | Black Duck Coverity user password |
| Page size | No | 100 | Maximum number of records to get per API request |
| Parallel requests | No | min(4, availableProcessors) | Maximum number of parallel API requests |
| Defect analysis | No | false | Include detailed code analysis. |
| Code snippet | No | false | Include code snippet. |
| Code snippet lines | No | 3 | Number of lines of code snippet to be included. |
| SSL / TLS | No | false | Skip certificate verification |
Authentication
Method
WS-Security UsernameToken profile with plaintext credentials, applied to every outgoing SOAP request.
Endpoint
| Method | URL |
|---|---|
POST | <base-url>/ws/v9/configurationservice (WSDL: <base-url>/ws/v9/configurationservice?wsdl) |
POST | <base-url>/ws/v9/defectservice (WSDL: <base-url>/ws/v9/defectservice?wsdl) |
Request Headers
| Header | Value |
|---|---|
Content-Type | text/xml; charset=UTF-8 |
SOAPAction | (operation-specific) |
Security Header (injected into SOAP envelope)
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"
xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:UsernameToken>
<wsse:Username><!-- configured username --></wsse:Username>
<wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">
<!-- configured password -->
</wsse:Password>
</wsse:UsernameToken>
</wsse:Security>
Usage
The header is added by WSSAuthenticationHandler (a JAX-WS SOAPHandler) attached to both service BindingProviders on every request — there is no separate authentication call.
Sync Behavior
The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.
How to obtain Black Duck Coverity (SOAP) credentials
Create a Black Duck Coverity user account
For the Black Duck Coverity (SOAP) connector to use the Coverity API, Brinqa recommends creating a dedicated user account in Black Duck Coverity with the appropriate role to retrieve data. To create the user account, follow these steps:
-
Log in to your organization's Black Duck Coverity server as an administrator.
-
Navigate to Configuration > Users & Groups.
-
Click Add and create a new user account.
Complete the Username, First name, Last name, Email, and Password fields. Leave the remaining fields as-is.
-
Click Create.
The new user account is now created but does not yet have any assigned roles or permissions. To assign a role to the user, follow these steps:
-
In the Users & Groups section, locate the newly created user account in the list.
-
Select the account, click the Roles tab, then click Edit under the Global scope.
Roles assigned under the Global scope apply across all projects. If your organization enforces project-specific permissions, ensure that the user account has access to all relevant data scopes. For additional information on roles and access management, see the Coverity documentation on roles and role-based access control
-
Select the Observer role from the list of available roles.
The Observer role is considered the minimum role required to access the Coverity API and retrieve data.
-
Click OK, then click Done to ensure that you save your changes.
Note: If you do not have permissions to create a new account or assign roles, contact your Black Duck Coverity administrator. For additional information, see the Black Duck Coverity documentation on configuring users and roles.
(Optional) Create a Black Duck Coverity service account
In addition to creating a new user account with the Observer role, you can also create and assign a service account to your project(s) in Black Duck Coverity. A service account is a dedicated account that is used for automated processes and integrations, such as the Black Duck Coverity (SOAP) connector. For additional information, see Black Duck Coverity documentation on how to create a service account and assign it to a project.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Project
| Source Field Name | SDM Attribute |
|---|---|
constant | CATEGORIES |
constant | STATUS |
ProjectDataObj.dateCreated | SOURCE_CREATED_DATE |
ProjectDataObj.dateModified | SOURCE_LAST_MODIFIED |
ProjectDataObj.description | DESCRIPTION |
ProjectDataObj.id.name | NAME |
ProjectDataObj.projectKey | UID |
SnapshotInfoDataObj.dateCreated (latest snapshot) | LAST_COMMIT |
SnapshotInfoDataObj.sourceVersion (latest snapshot) | LAST_VERSION |
SnapshotInfoDataObj.target (latest snapshot) | LAST_TARGET |
Defect
| Source Field Name | SDM Attribute |
|---|---|
"CWE-" + MergedDefectDataObj.cwe (fallback: displayType) | TYPE |
[ProjectDataObj.projectKey] | TARGETS |
DefectState["Comment"] | COMMENT |
DefectState["DefectStatus"] (raw) | PROVIDER_STATUS |
DefectState["Legacy"] | LEGACY |
| derived from STATUS | STATUS_CATEGORY |
| derived from stream-defect analysis events | RESULTS |
| derived from StreamDefectDataObj contributing events | EVENTS |
dynamic, from ConfigurationService.getAttributes() | <custom attributes> |
MergedDefectDataObj.cid | UID |
MergedDefectDataObj.cid | NAME |
MergedDefectDataObj.componentName | COMPONENT |
MergedDefectDataObj.displayCategory | CATEGORIES |
MergedDefectDataObj.filePathname | FILE_NAME |
MergedDefectDataObj.firstDetected | FIRST_FOUND |
MergedDefectDataObj.firstDetectedBy | FIRST_DETECTED_BY |
MergedDefectDataObj.firstDetectedDescription | FIRST_SNAPSHOT_DESC |
MergedDefectDataObj.firstDetectedSnapshotId | FIRST_SNAPSHOT_ID |
MergedDefectDataObj.firstDetectedStream | FIRST_SNAPSHOT_STREAM |
MergedDefectDataObj.firstDetectedTarget | FIRST_SNAPSHOT_TARGET |
MergedDefectDataObj.firstDetectedVersion | FIRST_SNAPSHOT_VERSION |
MergedDefectDataObj.functionName | FUNCTION_NAME |
MergedDefectDataObj.lastDetected | LAST_FOUND |
MergedDefectDataObj.lastDetectedDescription | LAST_SNAPSHOT_DESC |
MergedDefectDataObj.lastDetectedSnapshotId | LAST_SNAPSHOT_ID |
MergedDefectDataObj.lastDetectedStream | LAST_SNAPSHOT_STREAM |
MergedDefectDataObj.lastDetectedTarget | LAST_SNAPSHOT_TARGET |
MergedDefectDataObj.lastDetectedVersion | LAST_SNAPSHOT_VERSION |
MergedDefectDataObj.lastFixed | LAST_FIXED |
MergedDefectDataObj.lastTriaged | LAST_TRIAGED |
MergedDefectDataObj.mergeKey | MERGE_KEY |
MergedDefectDataObj.occurrenceCount | OCCURRENCES |
normalized from DefectState["DefectStatus"] | STATUS |
normalized from DefectState["DefectStatus"] | SOURCE_STATUS |
ProjectDataObj.id.name | PROJECT_NAME |
ProjectDataObj.projectKey | PROJECT_ID |
Defect Type
| Source Field Name | SDM Attribute |
|---|---|
"CWE-" + MergedDefectDataObj.cwe (fallback: displayType, then UNKNOWN) | UID |
["CWE-" + MergedDefectDataObj.cwe] | CWE_IDS |
["CWE-" + MergedDefectDataObj.cwe] | WEAKNESSES |
[MergedDefectDataObj.issueKind] | CATEGORIES |
[MergedDefectDataObj.language] | LANGUAGES |
| derived from normalized severity | SEVERITY_SCORE |
MergedDefectDataObj.checkerName | CHECKER |
MergedDefectDataObj.displayImpact | IMPACT |
MergedDefectDataObj.displayImpact | SOURCE_SEVERITY |
MergedDefectDataObj.displayType (fallback: UID) | NAME |
| normalized from displayImpact | SEVERITY |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Project
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
namePattern | String | Wildcard pattern applied to ProjectFilterSpecDataObj.namePattern | * |
descriptionPattern | String | Wildcard pattern applied to ProjectFilterSpecDataObj.descriptionPattern | * |
Delta sync
Supported.
API
- Type: SOAP / JAX-WS
Defect
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
namePattern | String | Project filter applied during defect enumeration | * |
descriptionPattern | String | Project filter applied during defect enumeration | * |
checkerList | String | Comma-separated checker names; populates ProjectScopeDefectFilterSpecDataObj.checkerList | (empty) |
Delta sync
Supported.
API
- Type: SOAP / JAX-WS
Defect Type
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: SOAP / JAX-WS (derived from the same defect query as
Defect)
Changelog
The Black Duck Coverity (SOAP) connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.2.8 | No changes in this release. | N/A |
| 3.2.7 | Improvements - Models now write attributes through the platform's shared, type-validating attribute helper instead of connector-local helpers. Attribute values are now validated against the declared schema type at write time, which surfaces type mismatches early rather than silently storing the wrong type. | N/A |
| 3.2.6 | Improvements - Connector-sourced attribute values now take precedence over non-connector data channels (manual edits, bulk imports, UI input) when the platform consolidates records, so Synopsys data is no longer overridden by lower-priority sources. | N/A |
| 3.2.5 | No changes in this release. | N/A |
| 3.2.4 | No changes in this release. | N/A |
| 3.2.3 | No changes in this release. | N/A |
| 3.2.2 | No changes in this release. | N/A |
| 3.2.1 | No changes in this release. | N/A |
| 3.2.0 | No changes in this release. | N/A |
| 3.1.2 | No changes in this release. | N/A |
| 3.1.1 | Bug Fixes - Fixed cached merged defects being skipped on sync. When defects for a project were already present in the connector's local store, the cached records were ignored instead of returned, which could cause defects to be missed; the cached defects are now processed correctly. - Hardened defect attribute parsing to skip entries with missing or blank attribute names or values, preventing malformed defect attributes from disrupting the sync. | N/A |
| 3.1.0 | Overview The Coverity connector integrates with Coverity (Synopsys) over its SOAP web services to synchronize static analysis projects and the defects identified in them. Category: Application Security Models | N/A |