Checkmarx SAST

Application Security

Overview

The CheckmarxSast connector integrates with the on-premise Checkmarx SAST (CxSAST) platform. It syncs the organizational team hierarchy, applications, and code projects, along with the scans (assessments) run against those projects and the findings they produce: SAST static-code findings (and their definitions) and OSA (Open Source Analysis) open-source findings, definitions, and packages.

Data retrieved from CheckmarxSast

Connector Object	Required	Maps to Data Model
Team	Yes	Team
Application	Yes	Application
CodeProject	Yes	Code Project
Assessment	Yes	Assessment
Package	Yes	Package
StaticCodeFinding	Yes	Static Code Finding
StaticCodeFindingDefinition	Yes	Static Code Finding Definition
OpenSourceFinding	Yes	Open Source Finding
OpenSourceFindingDefinition	Yes	Open Source Finding Definition

Model relationships

note

For detailed steps on how to view the data retrieved from CheckmarxSast in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select CheckmarxSast from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Server URL	Yes	Default - (user input, Required)	Checkmarx Server URL
Username	Yes	Default - (user input, Required)	Checkmarx username
Password	Yes	Default - (user input, Required)	Checkmarx user password
Project remote setting	No	false	Include project remote setting.
Page size	No	100	Maximum number of records to get per API request
Parallel requests	No	min(2, available processors)	Maximum number of parallel API requests
SSL / TLS	No	false	Skip certificate verification
Maximum retries	No	5	The maximum number of retry attempts before giving up a request
Requests per minute	No	100	Maximum number of API requests per minute
API Timeout	No	300	The maximum time to wait for an API response in seconds. Maximum allowed value 14400 seconds (4 hours)

Authentication

CheckmarxSast uses OAuth2 (resource-owner password grant). The connector exchanges the configured CxSAST username and password for a bearer token, which it then attaches to every API request.

Token Endpoint

Method	URL
POST	{url}/cxrestapi/auth/identity/connect/token

Request Headers

Header	Value
Content-Type	application/x-www-form-urlencoded

Request Body (form-encoded)

{
  "username": "{username}",
  "password": "{password}",
  "grant_type": "password",
  "scope": "sast_rest_api",
  "client_id": "resource_owner_client"
}

Sample Response

{
  "access_token": "eyJhbGciOi***",
  "expires_in": 86400,
  "token_type": "Bearer"
}

Response Fields

Field	Description
access_token	Bearer token used to authorize subsequent API requests.
expires_in	Token lifetime in seconds. The connector refreshes the token shortly before this elapses.
token_type	Always Bearer.

Using the Token

Every API request to the CxSAST REST API ({url}/cxrestapi/...) carries the header:

Authorization: Bearer {access_token}

The token is cached and renewed when it is within 5 seconds of expiry.

Sync Behavior

The connector performs a mix of full and incremental (delta) syncs depending on the model. Models that support delta filter by the sync token (see each model's Sync Duration Parameter below); the rest perform a full sync every run.

---

How to obtain CheckmarxSast credentials

Note: The Checkmarx SAST user must have at least the Reviewer role assigned to them in order to retrieve data from the Checkmarx SAST API, as it is the minimum role required for API access. For additional information on roles and permissions, see Checkmarx SAST documentation.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Team

Source Field Name	SDM Attribute
sync timestamp	LAST_CAPTURED
Team.fullName	NAME
Team.id	UID

Application

Source Field Name	SDM Attribute
Constant	CATEGORIES
Derived	UID
Derived	NAME
Sync timestamp	LAST_CAPTURED

CodeProject

Source Field Name	SDM Attribute
Constant	CATEGORIES
Latest scan finish time	LAST_SEEN
Project.id	UID
Project.isDeprecated	IS_DEPRECATED
Project.isPublic	IS_PUBLIC
Project.name	NAME
Project.teamId	TEAM_ID
RemoteSourceSettings.branch	BRANCH
RemoteSourceSettings.paths	PATHS
RemoteSourceSettings.url	URL
Scan.owner	OWNER
ScanState.cxVersion	CX_VERSION
ScanState.failedLinesOfCode	FAILED_LOC
ScanState.filesCount	FILE_COUNT
ScanState.linesOfCode	LOC
Sync timestamp	LAST_CAPTURED

Assessment

Source Field Name	SDM Attribute
Derived	SCAN_SCOPE
Scan name	NAME
Scan.dateAndTime.finishedOn	LAST_STOPPED
Scan.dateAndTime.startedOn	LAST_STARTED
Scan.id	UID
Scan.project.id	TARGETS
Scan.project.name	PROJECT_NAME
Scan.scanType	SCAN_TYPE
Scan.scanType	CATEGORIES
Scan.status.name	STATUS
Sync timestamp	LAST_CAPTURED

Package

Source Field Name	SDM Attribute
Constant	CATEGORIES
Library.id	UID
Library.licenses	LICENSES
Library.matchType	MATCH_TYPE
Library.name	NAME
Library.newestVersion	LATEST_VERSION
Library.outdated	OUTDATED
Library.releaseDate	FIRST_SEEN
Library.version	CURRENT_VERSION
Scan project	PROJECTS
Sync timestamp	LAST_CAPTURED

StaticCodeFinding

Source Field Name	SDM Attribute
md5 of path / query / file / node data	UID
PathNode.FileName	FILE_NAME
Query categories	CATEGORIES
Query type	TYPE
Query.Language	LANGUAGES
Result.Status	PROVIDER_STATUS
Result.Status	SOURCE_STATUS
Scan time	LAST_FOUND
Scan.project.id	TARGETS
Snippet	CODE_SNIPPET
Sync timestamp	LAST_CAPTURED

StaticCodeFindingDefinition

Source Field Name	SDM Attribute
Query categories	CATEGORIES
Query description	RECOMMENDATION
Query.cweId	CWE_IDS
Query.cweId	WEAKNESSES
Query.group	QUERY_GROUP
Query.id	UID
Query.name	NAME
Query.name	QUERY_NAME
Query.Severity	SEVERITY
Query.Severity	SOURCE_SEVERITY
Query.Severity	SEVERITY_SCORE
Sync timestamp	LAST_CAPTURED

OpenSourceFinding

Source Field Name	SDM Attribute
CheckmarxSAST- + Vuln.cveName	TYPE
Constant active	PROVIDER_STATUS
Derived	UID
Lib.id	LIBRARY_ID
Lib.id	TARGETS
Scan project	PROJECT_ID
Scan.endAnalyzeTime	LAST_FOUND
Scan.id	ASSESSMENT
State	SOURCE_STATUS
State	STATE
Sync timestamp	LAST_CAPTURED
Vuln.cveName	NAME
Vuln.id	VULNERABILITY_ID
Vuln.score	SCORE
Vuln.sourceFileName	FILE_NAME

OpenSourceFindingDefinition

Source Field Name	SDM Attribute
Definition UID	NAME
Sync timestamp	LAST_CAPTURED
Vuln.cveName	CVE_IDS
Vuln.cveName	CVE_RECORDS
Vuln.description	DESCRIPTION
Vuln.id	UID
Vuln.publishDate	PUBLISHED_DATE
Vuln.recommendations	RECOMMENDATION
Vuln.severity	SEVERITY
Vuln.severity	SOURCE_SEVERITY
Vuln.severity	SEVERITY_SCORE
Vuln.url	REFERENCES

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Team

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Team on every run and applies no incremental date filter.

API

• Type: See connector README · Endpoint: GET /cxrestapi/auth/teams

Application

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Application on every run and applies no incremental date filter.

API

• Type: See connector README · Endpoint: Derived from project / team data.

CodeProject

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of CodeProject on every run and applies no incremental date filter.

API

• Type: See connector README · Endpoint: GET /cxrestapi/projects (optionally enriched with GET /sourceCode/remoteSettings/ when the Include Project Remote Setting option is enabled)

Assessment

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Assessment on every run and applies no incremental date filter.

API

• Type: See connector README · Endpoint: GET /cxrestapi/sast/scans

Package

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on scan.endAnalyzeTime.

API

• Type: See connector README · Endpoint: GET /cxrestapi/osa/libraries (with GET /cxrestapi/osa/scans)

StaticCodeFinding

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token.

API

• Type: See connector README · Endpoint: GET /cxrestapi/reports/sastScan / GET /cxrestapi/reports/sastScan/{id} / GET /cxrestapi/reports/sastScan/{id}/status (XML scan report)

StaticCodeFindingDefinition

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token.

API

• Type: See connector README · Endpoint: SAST scan report queries (same report endpoints as StaticCodeFinding)

OpenSourceFinding

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on scan.endAnalyzeTime.

API

• Type: See connector README · Endpoint: GET /cxrestapi/osa/vulnerabilities (with GET /cxrestapi/osa/scans)

OpenSourceFindingDefinition

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on scan.endAnalyzeTime.

API

• Type: See connector README · Endpoint: GET /cxrestapi/osa/vulnerabilities

Changelog

Changelog

The CheckmarxSast connector has undergone the following changes:

Version	Description	Migration Steps
3.2.7	Improvements - Checkmarx SAST records now include a "Last Captured" timestamp on every model (teams, applications, code projects, scans, packages, static code findings and definitions, and open source findings and definitions), recording when each record was last synced for more accurate data-freshness tracking in Brinqa. Bug Fixes - Fixed a sync error that could occur when a Checkmarx query definition had no severity assigned. - Prevented temporary sync storage from being removed while it may still be in use by an overlapping sync, improving the reliability of concurrent Checkmarx SAST syncs.	N/A
3.2.6	New Features - Checkmarx SAST now exposes a configurable API read timeout (up to 4 hours), letting large SAST instances finish slow report and scan-result downloads without timing out. Improvements - Checkmarx SAST static code findings are now collected from projects in parallel and filtered to scans completed since the last sync, reducing sync times and load on the Checkmarx server.	N/A
3.2.5	New Features - Checkmarx SAST adds a configurable requests-per-minute limit, allowing the connector to stay within Checkmarx API rate limits during large syncs.	N/A
3.2.4	New Features - Checkmarx SAST adds a configurable maximum-retries setting, giving you control over how persistently the connector retries failed API requests before skipping them. Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.2.3	Improvements - Checkmarx SAST findings are now processed as they are fetched rather than fully buffered first, lowering memory usage and improving stability during large scans.	N/A
3.2.2	No changes in this release.	N/A
3.2.1	No changes in this release.	N/A
3.2.0	No changes in this release.	N/A
3.1.3	No changes in this release.	N/A
3.1.2	No changes in this release.	N/A
3.1.1	Improvements - Added automatic lifecycle handling for Checkmarx SAST: applications and code projects are aged out after 180 days without activity, and findings inherit the lifecycle of the asset they belong to, keeping stale records from lingering.	N/A
3.1.0	No changes in this release.	N/A
3.0.8	Improvements - Checkmarx SAST static code findings now display a clearer finding name derived from the analyzed path. Bug Fixes - Reworked how Checkmarx SAST static code findings and finding definitions are identified so findings sharing the same CWE but representing different rules are no longer merged together.	• Static Code Finding / Static Code Finding Definition (Checkmarx SAST): The identifiers used for these findings and definitions changed, so previously synced records will not match the new ones. Action: purge the Checkmarx SAST static code finding and finding definition data and re-sync the connector. ---
3.0.7	Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.6	Bug Fixes - Fixed Checkmarx SAST static code finding status handling so results are only marked as a false positive when Checkmarx actually flags them as such.	• Static Code Finding (Checkmarx SAST): Finding status values are now derived correctly, changing stored status values for affected findings. Action: re-sync the connector to refresh finding statuses. ---
3.0.5	No changes in this release.	N/A
3.0.4	Bug Fixes - Corrected the data type of the Checkmarx SAST code project "Is deprecated" attribute so it is stored as a true/false value.	• Code Project (Checkmarx SAST): The "Is deprecated" attribute changed from a numeric type to a true/false value. Action: re-sync the connector so the attribute is stored in the new format. ---
3.0.3	New Features - Added the Checkmarx SAST connector for on-premises Checkmarx CxSAST, syncing teams, applications, code projects, scans (assessments), static code findings, and open source findings and packages.	N/A