Checkmarx One

Application Security

Overview

The CheckmarxOne connector integrates with the Checkmarx One application security testing (AST) cloud platform. It syncs applications and code projects together with the scans (assessments) run against them, and the findings those scans produce: SAST static-code findings (and their definitions), KICS infrastructure-as-code findings (and their definitions), SCA open-source findings (and their definitions), and the open-source packages discovered during SCA scans.

Data retrieved from Checkmarx One

Connector Object	Required	Maps to Data Model
Application	Yes	Application
CodeProject	Yes	Code Project
Assessment	Yes	Assessment
StaticCodeFinding	Yes	Static Code Finding
StaticCodeFindingDefinition	Yes	Static Code Finding Definition
OpenSourceFinding	Yes	Open Source Finding
OpenSourceFindingDefinition	Yes	Open Source Finding Definition
Package	Yes	Package
InfrastructureAsCodeFinding	Yes	Static Code Finding
InfrastructureAsCodeFindingDefinition	Yes	Static Code Finding Definition

Model relationships

note

For detailed steps on how to view the data retrieved from Checkmarx One in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Checkmarx One from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Api URL	No	—	Checkmarx One Api URL
Client ID	No	—	Checkmarx One Client ID
Client Secret	No	—	Checkmarx One Client Secret
Login URL	No	—	Checkmarx One Login URL
Client Realm	No	—	Realm Client Config
Page size	No	—	Maximum number of records to get per API request
Parallel requests	No	—	Maximum number of parallel API requests
Maximum retries	No	—	The maximum number of retry attempts before giving up a request

Authentication

CheckmarxOne uses OAuth2 (client-credentials grant) against the Checkmarx One identity provider (Keycloak). The connector exchanges an OAuth client ID and secret for a short-lived bearer token, which it then attaches to every API request.

Token Endpoint

Method	URL
POST	{loginUrl}/auth/realms/{realm}/protocol/openid-connect/token

Request Headers

Header	Value
Content-Type	application/x-www-form-urlencoded

Request Body (form-encoded)

{
  "grant_type": "client_credentials",
  "client_id": "{clientId}",
  "client_secret": "{clientSecret}"
}

Sample Response

{
  "access_token": "***D0W6EfOyqEwUPorWg",
  "expires_in": 1799,
  "refresh_expires_in": 0,
  "token_type": "Bearer",
  "not-before-policy": 0,
  "scope": "iam-api groups roles ast-api email profile"
}

Response Fields

Field	Description
access_token	Bearer token used to authorize subsequent API requests.
expires_in	Token lifetime in seconds. The connector refreshes the token shortly before this elapses.
refresh_expires_in	Refresh-token lifetime in seconds.
token_type	Always Bearer.
not-before-policy	Keycloak "not before" policy timestamp.
scope	OAuth scopes granted to the token.

Using the Token

Every API request to the Checkmarx One platform ({url}/api/...) carries the header:

Authorization: Bearer {access_token}

The token is cached and automatically renewed when it is within 5 seconds of expiry.

To obtain credentials: log in to your Checkmarx One tenant, open the Identity and Access Management menu, navigate to OAuth Clients, and create a client ID and client secret.

How to obtain Checkmarx One credentials

Generate a Checkmarx One client secret

For the Checkmarx One connector to use the Checkmarx One API, you must provide a client secret. Checkmarx One does not allow retrieving the client secret for an existing user, therefore, you must generate a new client secret instead. To do so, follow these steps:

1. Log in to your Checkmarx One portal.

2. On the left-hand side of the page, click Settings, and then click Identity and Access Management.

3. Click OAuth Clients, and then click Create Client.

4. Provide a Client ID and click Create client.

   The page reloads and your new client ID displays.

5. Click Regenerate.

   A window appears with your new client secret. You cannot view it again. Copy the client secret and save it in a secure location.

6. Click Ok.

7. Scroll down to Role mapping, locate the ast-viewer role, and click Add.

   This permission allows for viewing the Checkmarx One projects, scans, and results.

8. Click Save Client.

Note: If you do not have the permissions to create a client secret, contact your Checkmarx One administrator. For additional information, see Checkmarx One documentation.

Obtain your Checkmarx One client realm

There are two ways you can obtain your client realm. You can obtain your Checkmarx One client by following these steps:

1. Log in to your Checkmarx One portal.

2. On the left-hand side of the page, click Identity and Access Management.

3. Once you are on the Identity and Access Management page, locate the {client-realm} value in the URL of the page.

   The Client Realm is an alphanumeric value, and the URL should resemble the following: https://iam.checkmarx.net/auth/admin/{client-realm}/console/#/realms/{client-realm}, where {client-realm} represents the actual Client Realm value that you must use in authenticating Checkmarx One with Brinqa.

You can also obtain your Checkmarx One client realm by following these steps:

1. Log in to your Checkmarx One portal.

2. Click Account Settings, represented by a gear icon.

   The Client Realm displays under the License tab:

   

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Application

Source Field Name	SDM Attribute
Application.createdAt	FIRST_SEEN
Application.criticality	CRITICALITY
Application.description	DESCRIPTION
Application.id	UID
Application.name	NAME
Application.tags	TAGS
Application.updatedAt	SOURCE_LAST_MODIFIED
Constant	CATEGORIES
Sync timestamp	LAST_CAPTURED

CodeProject

Source Field Name	SDM Attribute
Application.projectIds	APPLICATIONS
Project.createdAt	FIRST_SEEN
Project.criticality	CRITICALITY
Project.id	UID
Project.mainBranch	MAIN_BRANCH
Project.name	NAME
Project.repoUrl	REPO_URL
Project.repoUrl / Project.mainBranch	DESCRIPTION
Project.tags, Project.groups	TAGS
Project.updatedAt	SOURCE_LAST_MODIFIED

Assessment

Source Field Name	SDM Attribute
Scan.branch	BRANCH
Scan.createdAt	START_TIME
Scan.id	UID
Scan.initiator	INITIATOR
Scan.projectId	TARGETS
Scan.projectName	PROJECT_NAME
Scan.sourceOrigin	SOURCE_ORIGIN
Scan.sourceType	SOURCE_TYPE
Scan.status	STATUS
Scan.statusDetails[].loc	LINES_OF_CODE
Scan.tags	TAGS
Scan.updatedAt	END_TIME

StaticCodeFinding

Source Field Name	SDM Attribute
Derived from source/sink nodes	PATH
Result.compliances	COMPLIANCES
Result.confidenceLevel	CONFIDENCE_LEVEL
Result.firstFoundAt	FIRST_FOUND
Result.firstScanID	FIRST_SCAN_ID
Result.foundAt	LAST_FOUND
Result.group	TAGS
Result.languageName	LANGUAGES
Result.nodes	RESULTS
Result.pathSystemID (or Result.resultHash)	UID
Result.queryID	TYPE
Result.queryName	NAME
Result.similarityID	SIMILARITY_ID
Result.state	STATE
Result.status	PROVIDER_STATUS
Result.status	SOURCE_STATUS
Result.uniqueID	UNIQUE_ID
Scan.id	ASSESSMENT
Scan.projectId	TARGETS

StaticCodeFindingDefinition

Source Field Name	SDM Attribute
cause	CAUSE
cweID	CWE_IDS
cweID	WEAKNESSES
generalRecommendations	GENERAL_RECOMMENDATIONS
generalRecommendations, samples	RECOMMENDATION
queryID	UID
queryName / queryDescriptionId	NAME
resultDescription	RESULT_DESCRIPTION
resultDescription, risk, cause	DESCRIPTION
risk	RISK
Scan.projectId	TARGETS
severity	SEVERITY
severity	SOURCE_SEVERITY
severity	SEVERITY_SCORE

OpenSourceFinding

Source Field Name	SDM Attribute
Derived	PROVIDER_STATUS
Derived	SOURCE_STATUS
exploitableMethods	EXPLOITABLE_METHODS
id	TYPE
isViolatingPolicy	TAGS
md5 of id + packageId	UID
packageId	TARGETS

OpenSourceFindingDefinition

Source Field Name	SDM Attribute
cvss2 components	CVSS_V2_BASE_SCORE, CVSS_V2_AV, CVSS_V2_AC, CVSS_V2_CI, CVSS_V2_II, CVSS_V2_AI, CVSS_V2_E, CVSS_V2_RL, CVSS_V2_RC
cvss2.vector	CVSS_V2_VECTOR
cvss3 components	CVSS_V3_BASE_SCORE, CVSS_V3_AV, CVSS_V3_AC, CVSS_V3_CI, CVSS_V3_II, CVSS_V3_AI, CVSS_V3_E, CVSS_V3_RL, CVSS_V3_RC
cvss3.vector	CVSS_V3_VECTOR
cwe	CWE_IDS
cwe	WEAKNESSES
description	DESCRIPTION
epssPercentile	EPSS_PERCENTILE
epssValue	EPSS_SCORE
firstFoundAt	FIRST_FOUND
fixResolutionText	FIX_RESOLUTION_TEXT
id	UID
id	NAME
id	CVE_IDS
id	CVE_RECORDS
publishDate	PUBLISHED_DATE
references	REFERENCES
score	SCORE
severity	SEVERITY
severity	SOURCE_SEVERITY
severity	SEVERITY_SCORE

Package

Source Field Name	SDM Attribute
IsDevelopmentDependency, IsTestDependency, IsNpmVerified, IsDirectDependency, IsViolatingPolicy	TAGS
Package.HighVulnerabilityCount	HIGH_VULNERABILITY_COUNT
Package.Id	UID
Package.Licenses	LICENSES
Package.LowVulnerabilityCount	LOW_VULNERABILITY_COUNT
Package.MediumVulnerabilityCount	MEDIUM_VULNERABILITY_COUNT
Package.Name	NAME
Package.NewestVersion	LATEST_VERSION
Package.NewestVersionReleaseDate	NEWEST_VERSION_RELEASE_DATE
Package.NewestVersionReleaseDate	SOURCE_LAST_MODIFIED
Package.NumberOfVersionsSinceLastUpdate	NUMBER_OF_VERSIONS_SINCE_LAST_UPDATE
Package.Outdated	OUTDATED
Package.PackageRepository	PACKAGE_REPOSITORY
Package.ReleaseDate	RELEASE_DATE
Package.ReleaseDate	FIRST_SEEN
Package.RiskScore	RISK_SCORE
Package.Severity	SEVERITY
Package.Version	CURRENT_VERSION
RiskReportSummary.ProjectName	PROJECT_NAME
Scan.id	SCAN_ID
Scan.ProjectId	PROJECTS

InfrastructureAsCodeFinding

Source Field Name	SDM Attribute
actualValue, value	RESULTS
comments	COMMENTS
fileName, line	PATH
firstFoundAt	FIRST_FOUND
firstScanID	ASSESSMENT
foundAt	LAST_FOUND
ID	UID
platform	PLATFORM
queryID	TYPE
Scan project	TARGETS
similarityID	SIMILARITY_ID
state	STATE
status	PROVIDER_STATUS
status	SOURCE_STATUS
type	CATEGORIES

InfrastructureAsCodeFindingDefinition

Source Field Name	SDM Attribute
category	CATEGORIES
description	DESCRIPTION
queryName	NAME
severity	SEVERITY
severity	SOURCE_SEVERITY
severity	SEVERITY_SCORE

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Application

Operation options

This object does not support any operation options.

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: See connector README · Endpoint: GET /api/applications

CodeProject

Operation options

This object does not support any operation options.

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: See connector README · Endpoint: GET /api/projects

Assessment

Operation options

This object does not support any operation options.

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: See connector README · Endpoint: GET /api/scans?from-date={since}

StaticCodeFinding

Operation options

This object does not support any operation options.

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: See connector README · Endpoint: GET /api/sast-results?scan-id={scanId}&include-nodes=true

StaticCodeFindingDefinition

Operation options

This object does not support any operation options.

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: See connector README · Endpoint: GET /api/sast-results?scan-id={scanId}

OpenSourceFinding

Operation options

This object does not support any operation options.

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: See connector README · Endpoint: GET /api/sca/export/requests

OpenSourceFindingDefinition

Operation options

This object does not support any operation options.

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: See connector README · Endpoint: GET /api/sca/export/requests

Package

Operation options

This object does not support any operation options.

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: See connector README · Endpoint: GET /api/sca/risk-management/reporting/packages

InfrastructureAsCodeFinding

Operation options

This object does not support any operation options.

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: See connector README · Endpoint: GET /api/kics-results?scan-id={scanId}

InfrastructureAsCodeFindingDefinition

Operation options

This object does not support any operation options.

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: See connector README · Endpoint: GET /api/kics-results?scan-id={scanId}

Changelog

Changelog

The Checkmarx One connector has undergone the following changes:

Version	Description	Migration Steps
3.2.8	No changes in this release.	N/A
3.2.7	No changes in this release.	N/A
3.2.6	No changes in this release.	N/A
3.2.5	Improvements - Checkmarx One packages are now retrieved through the Software Composition Analysis export API, producing more complete and reliable package data.	• Package (Checkmarx One): The identifier used for package assets changed, so existing package records will not match the newly synced ones. Action: purge the Checkmarx One Package data and re-sync the connector. ---
3.2.4	New Features - Checkmarx One adds a configurable maximum-retries setting, giving you control over how persistently the connector retries failed API requests before skipping them. Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.2.3	No changes in this release.	N/A
3.2.2	Improvements - The "Exploitable methods" detail for Checkmarx One open source findings now appears on the individual finding rather than the shared finding definition, giving a more accurate per-finding view.	• Open Source Finding / Open Source Finding Definition (Checkmarx One): The "Exploitable methods" attribute moved between models. Action: re-sync the connector so the attribute is populated on the correct model. ---
3.2.1	Bug Fixes - Fixed a threading issue in Checkmarx One Software Composition Analysis export processing so finding records are handled reliably on the intended worker pool.	N/A
3.2.0	Improvements - Checkmarx One open source findings are now retrieved through the asynchronous Software Composition Analysis export API, producing more complete results for large projects. - Reworked CVSS scoring support for open source findings to handle CVSS v2, v3, and v4 vectors.	N/A
3.1.3	Improvements - Checkmarx One open source finding definitions now capture multiple exploitable methods instead of a single value. Bug Fixes - Fixed CVSS vector parsing for Checkmarx One open source finding definitions so malformed vectors are skipped gracefully, duplicate scores are no longer produced, and CVSS 3.0 vectors are built with the correct prefix.	• Open Source Finding Definition (Checkmarx One): The "Exploitable methods" attribute changed from a single value to a multi-valued attribute. Action: re-sync the connector so the attribute is stored in the new format. ---
3.1.2	Improvements - Checkmarx One now requests the latest scan per analysis engine (static code, Software Composition Analysis, and infrastructure-as-code) separately, so each finding type is matched to the correct scan. - Improved error handling for missing resources, so a not-found response on one project no longer interrupts the rest of the sync.	N/A
3.1.1	Improvements - Added automatic lifecycle handling for Checkmarx One: applications and code projects are aged out after 180 days without activity, and findings inherit the lifecycle of the asset they belong to, keeping stale records from lingering.	N/A
3.1.0	No changes in this release.	N/A
3.0.8	No changes in this release.	N/A
3.0.7	Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.6	No changes in this release.	N/A
3.0.5	Bug Fixes - Corrected the data type of the Checkmarx One "Criticality" attribute so its numeric value is stored and sorted correctly.	• Checkmarx One models: The "Criticality" attribute changed from text to a numeric type. Action: re-sync the connector so the attribute is stored in the new format. ---
3.0.4	No changes in this release.	N/A
3.0.3	No changes in this release.	N/A
3.0.2	Improvements - Configuration fields are now clearly marked as required and confidential, and date values are serialized consistently across the connector. - Last-scan lookups now return safely when no data is available, preventing errors during sync.	N/A
3.0.1	Bug Fixes - Checkmarx One open source findings are now linked to their code project as well as their package, so Software Composition Analysis results appear on the associated code project. - Static code finding paths now handle missing file names gracefully instead of failing.	N/A
3.0.0	Overview The Checkmarx One connector integrates with the Checkmarx One application security platform to synchronize applications, code projects, scans, and the static code, open source, and infrastructure-as-code findings (and their definitions and packages) produced by Checkmarx scanning. Category: Application Security Models	N/A