Fortify Static Code Analyzer
Application Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Fortify Static Code Analyzer (SCA) connector ingests Fortify Project Results (FPR) archives produced by Micro Focus / OpenText Fortify SCA scans. Each FPR is a ZIP archive containing audit.fvdl (scan results) and an optional audit.xml (audit/suppression data). The connector parses these files to produce code projects, static code findings, and reusable static code finding definitions.
Data retrieved from Fortify Static Code Analyzer
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Code Project | Yes | Code Project |
| Static Code Finding | Yes | Static Code Finding |
| Static Code Finding Definition | Yes | Static Code Finding Definition |
Model relationships
For detailed steps on how to view the data retrieved from Fortify Static Code Analyzer in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Fortify Static Code Analyzer from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Data Directory | Yes | — | File system directory the connector reads FPR archives from |
| Max Age | Yes | — | Maximum number of days a file will be retained; a value less than 0 indicates forever, 0 indicates do not keep the file |
| Max Files | Yes | — | Maximum number of files to retain; less than 0 indicates all, 0 indicates none |
| Suppressed | Yes | false | Include suppressed findings |
| Removed | Yes | false | Include removed findings |
| Post Process | No | false | Rename or move the file after it is processed |
Authentication
This is a file-ingestion connector — it does not authenticate against a remote API. FPR archives are read from a configured data directory on the file system. Access is controlled by the connector host's file system permissions.
Sync Behavior
Each sync is a full sync. Every run enumerates all records; the connector accepts a sync token but does not apply it as an incremental filter.
How to obtain Fortify Static Code Analyzer credentials
Obtain the required credentials (Data Directory, Max Age, Max Files, Suppressed, Removed) from your Fortify Static Code Analyzer administrator or the Fortify Static Code Analyzer admin console, then enter them in the connection settings above.
When Post Process is enabled, each ingested file is renamed by appending .processed to the file name, so the same file is not ingested again on subsequent syncs.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Code Project
| Source Field Name | SDM Attribute |
|---|---|
(generated) | CATEGORIES |
(generated) | STATUS |
Issue.projectName | NAME |
Issue.projectVersionID (falls back to Issue.projectName) | UID |
Static Code Finding
| Source Field Name | SDM Attribute |
|---|---|
Build.fortifyLOC | FORTIFY_LOC |
Build.id | BUILD_ID |
Build.label | BUILD_LABEL |
Build.numberOfFiles | NUMBER_OF_FILES |
Build.scanTime | SCAN_TIME |
Build.totalLOC | TOTAL_LOC |
EngineData.version | ENGINE_VERSION |
Issue.abstract + Issue.explanation | RESULTS |
Issue.classID | TYPE |
Issue.classID | CLASS_ID |
Issue.commentsLOC | COMMENTS_LOC |
Issue.confidence | CONFIDENCE |
Issue.dateRemoved (from audit.xml) | DATE_REMOVED |
Issue.enclosingClass (from Context) | ENCLOSING_CLASS |
Issue.function (from Context) | FUNCTION |
Issue.lastFound | LAST_FOUND |
Issue.namespace (from Context) | NAMESPACE |
Issue.projectName | PROJECT_NAME |
Issue.projectVersionID, Issue.projectName | TARGETS |
Issue.removed (from audit.xml) | REMOVED |
Issue.reportName | REPORT_NAME |
Issue.snippetFile + snippet start/end lines | PATH |
Issue.snippetID | SNIPPET_ID |
Issue.snippetLabel | SNIPPET_LABEL |
Issue.snippetText | CODE_SNIPPET |
Issue.sourceFile | SOURCE_FILE |
Issue.sourceLine | SOURCE_LINE |
Issue.sourceLOC | SOURCE_LOC |
Issue.sourcePath | SOURCE_PATH |
Issue.suppressed (from audit.xml) | SUPPRESSED |
Issue.sysID (Vulnerability InstanceID) | UID |
Issue.tags (from audit.xml) | TAGS |
Issue.whitespaceLOC | WHITESPACE_LOC |
Rule.accuracy / MetaInfo Accuracy | ACCURACY |
Rule.audience | AUDIENCE |
Rule.availabilityImpact | AVAILABILITY_IMPACT |
Rule.confidentialityImpact | CONFIDENTIALITY_IMPACT |
Rule.impact / MetaInfo Impact | IMPACT |
Rule.impactBias | IMPACT_BIAS |
Rule.integrityImpact | INTEGRITY_IMPACT |
Rule.primaryAudience | PRIMARY_AUDIENCE |
Rule.probability / MetaInfo Probability | PROBABILITY |
Rule.remediationEffort | REMEDIATION_EFFORT |
Static Code Finding Definition
| Source Field Name | SDM Attribute |
|---|---|
| derived from normalized severity | SEVERITY_SCORE |
EngineData.rulePackVersion | RULE_PACK_VERSION |
Issue.analyzerName | ANALYSER_NAME |
Issue.analyzerName + Issue.type + Issue.subtype | NAME |
Issue.classID | UID |
Issue.cwe | WEAKNESSES |
Issue.cwe (from Description) | CWE_IDS |
Issue.defaultSeverity | DEFAULT_SEVERITY |
Issue.instanceSeverity | SOURCE_SEVERITY |
Issue.kingdom | KINGDOM |
Issue.recommendation (+ explanation) | RECOMMENDATION |
Issue.subtype | RULE_SUBTYPE |
Issue.type | RULE_TYPE |
Issue.type, Issue.subtype | CATEGORIES |
normalized Issue.instanceSeverity | SEVERITY |
| same composite as NAME | DESCRIPTION |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Code Project
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
TRANSACTION_ID | String | — | Controls local-store partitioning for each ingested file |
Delta sync
Not supported. The connector performs a full sync of Code Project on every run and applies no incremental date filter.
API
- Type: File ingestion (FPR archive) · Endpoint:
Parsed from the FPR archive in the configured data directory; projects are de-duplicated by project version id (falling back to project name)
Static Code Finding
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
TRANSACTION_ID | String | — | Controls local-store partitioning for each ingested file |
Delta sync
Not supported. The connector performs a full sync of Static Code Finding on every run and applies no incremental date filter.
API
- Type: File ingestion (FPR archive) · Endpoint:
Parsed from - Default filters: Suppressed and removed findings are included according to the connector configuration
Static Code Finding Definition
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
TRANSACTION_ID | String | — | Controls local-store partitioning for each ingested file |
Delta sync
Not supported. The connector performs a full sync of Static Code Finding Definition on every run and applies no incremental date filter.
API
- Type: File ingestion (FPR archive) · Endpoint:
Derived from the same parsed FPR data as Static Code Finding; definitions are de-duplicated by class id
Changelog
The Fortify Static Code Analyzer connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.1.2 | Improvements - Connector-sourced attribute values now take precedence over non-connector data channels (manual edits, bulk imports, UI input) when the platform consolidates records, so MicroFocus Fortify data is no longer overridden by lower-priority sources. Bug Fixes - Corrected the data type of the "Source severity" attribute on the finding definitions. It was declared as text but populated with a numeric value; the numeric severity is now stored as text consistently. | • Findings and definitions: the "Source severity" attribute changed type. Re-sync the Fortify SCA connector to repopulate these records with the corrected value. |
| 3.1.1 | No changes in this release. | N/A |
| 3.1.0 | Improvements Dependency Upgrades - Updated underlying platform model and storage libraries along with the JSON processing library. No functional or schema changes for this connector. | N/A |
| 3.0.6 | No changes in this release. | N/A |
| 3.0.5 | No changes in this release. | N/A |
| 3.0.4 | Bug Fixes - Corrected the source-code location link on static code findings so that snippet line numbers are only appended when they are actually present, preventing malformed location references. | N/A |
| 3.0.3 | Improvements - Code projects are now matched on the project name when a project version identifier is unavailable, so projects from reports without a version are still synchronized. - Static code findings now resolve their target project using the project name as a fallback when the project version identifier is missing. - The "last found" date is now derived from the scan write date when it is not otherwise provided. | • Code Project: when a project version identifier is unavailable, the project name is now used as the record identifier. Re-sync the Fortify SCA connector to align existing code project records. |
| 3.0.2 | Bug Fixes - Finding definitions no longer record a severity when the scan does not report one, avoiding incorrect default severities being applied to findings without a source severity. | N/A |
| 3.0.1 | Overview The Fortify Static Code Analyzer connector integrates with Micro Focus Fortify Static Code Analyzer (SAST) to synchronize static analysis scan results, including scanned code projects, static code findings, and their finding definitions. Category: Application Security Models | N/A |