Skip to main content

Semgrep

Semgrep is a code analysis tool that scans code to find and fix security vulnerabilities, bugs, and style issues in your organization's codebase. You can bring analysis data from Semgrep into Brinqa to prioritize and track the remediation efforts of those potential code issues to gain a unified view of your attack surface and strengthen your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with Semgrep and how to obtain that information from Semgrep. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings​

When setting up a data integration, select Semgrep from the Connector dropdown. If you cannot find the connector in the dropdown, make sure that you have installed it first. You must provide the following information to authenticate Semgrep with Brinqa:

  • API URL: The Semgrep API URL. The default URL is https://semgrep.dev.

  • Access Token: The access token associated with the Semgrep account, which must have permissions to log in to the API server and return data.

    note

    The Semgrep account must be a Team or Enterprise tier account in order for the Semgrep connector to make API calls and return data.

Create a Semgrep access token​

For the Semgrep connector to use the Semgrep Web API, you must provide an access token. Semgrep does not allow retrieving the access token for an existing user, therefore, you must generate a new access token instead. To do so, follow these steps:

  1. Log in to the Semgrep application at https://semgrep.dev/login.

  2. Navigate to Settings and click Tokens.

  3. Click API tokens and then click Create new token.

  4. The Create a token window appears with the new token. Give the token a name or leave it as is.

    You cannot view the token after this. Copy the access token (Secrets value) and save it to a secure location.

  5. Under Token scopes, select Web API. This ensures that the Semgrep connector pulls information from the Semgrep Web API.

  6. Click Save.

    Semgrep access token user interface

note

The above steps describe the minimum requirements for the Semgrep connector to work properly with Brinqa. For additional information, see Semgrep documentation.

Additional settings​

The Semgrep connector contains additional options for specific configuration:

  • Parallel requests: The maximum number of parallel API requests. The default setting is 4.

  • Maximum retries: The maximum number of times that the integration attempts to connect to the Semgrep API before giving up and reporting a failure. The default setting is 10.

Types of data to retrieve​

The Semgrep connector can retrieve the following types of data from the Semgrep API:

Table 1: Data retrieved from Semgrep

Connector ObjectRequiredMaps to Data Model
Semgrep Code ProjectYesCode Project
Semgrep Open Source FindingYesOpen Source Finding
Semgrep Open Source Finding DefinitionYesOpen Source Finding Definition
Semgrep Static Code FindingYesStatic Code Finding
Semgrep Static Code Finding DefinitionYesStatic Code Finding Definition
info

The Semgrep connector does not currently support operation options for the types of data it retrieves.

For detailed steps on how to view the data retrieved from Semgrep in the Brinqa Platform, see How to view your data.

Attribute mappings​

Expand the sections below to view the mappings between the source and the Brinqa data model attributes.

Semgrep Code Project

Table 2: Semgrep Code Project Attribute Mappings

Semgrep Field NameSDM Attribute
activeSTATUS
project.categoriesCATEGORIES
project.nameNAME
project.nameUID
project.tagsTAGS
project.urlURL
Semgrep Open Source Finding

Table 3: Semgrep Open Source Finding Attribute Mappings

Semgrep Field NameSDM Attribute
buildPath(finding.location)PATH
finding.confidenceCONFIDENCE
finding.first_seen_scan_idFIRST_SEEN_SCAN_ID
finding.foundDependency.lockfileLineUrlFOUND_DEP_LOCKFILE_LINE_URL
finding.idUID
finding.location.columnSTART_COLUMN
finding.location.lineSTART_LINE
finding.location.endColumnEND_COLUMN
finding.location.endLineEND_LINE
finding.match_based_idMATCH_BASED_ID
finding.reachableConditionREACHABLE_CONDITION
finding.refSOURCE_REF
finding.repository.nameTARGETS
finding.repository.urlREPOSITORY_URL
finding.relevant_sinceFIRST_FOUND
finding.rule.cweNamesCWE_IDS
finding.rule.messageRULE_MESSAGE
finding.rule.nameTYPE
finding.statusPROVIDER_STATUS
finding.statusSOURCE_STATUS
finding.syntactic_idSYNTACTIC_ID
finding.triage_commentTRIAGED_COMMENT
finding.triage_stateTRIAGE_STATE
finding.triaged_atLAST_FIXED
finding.triaged_atTRIAGED_AT
finding.usageUSAGE
finding.foundDependency.ecosystemFOUND_DEP_ECOSYSTEM
finding.foundDependency.packageNameFOUND_DEP_PACKAGE
finding.foundDependency.transitivityFOUND_DEP_TRANSITIVITY
finding.foundDependency.versionFOUND_DEP_VERSION
finding.reachabilityREACHABILITY
normalizeFindingStatus(finding.status)SOURCE_STATUS
rule.cweNamesWEAKNESSES
Semgrep Open Source Finding Definition

Table 4: Semgrep Open Source Finding Definition Attribute Mappings

Semgrep Field NameSDM Attribute
finding.epssScore.percentileEPSS_PERCENTILE
finding.epssScore.scoreEPSS_SCORE
finding.findingTypeCATEGORIES
finding.fix_recommendations.each → packageName + " : " + versionFIX_RECOMMENDATIONS
finding.idNAME, UID
finding.rule.cweNamesCWE_IDS, WEAKNESSES
finding.rule.message.get(DESCRIPTION)DESCRIPTION
finding.rule.message.get(RECOMMENDATION)RECOMMENDATION
finding.severitySOURCE_SEVERITY
finding.vulnerability_identifierCVE_IDS
getFindingSeverityScore(finding.severity)SEVERITY_SCORE
normalizeFindingSeverity(finding.severity)SEVERITY
Semgrep Static Code Finding

Table 5: Semgrep Static Code Finding attribute mappings

Semgrep Field NameSDM Attribute
buildPath(finding.location)PATH
finding.assistant.autofix.explanationASSISTANT_AUTOFIX_EXPLANATION
finding.assistant.autofix.fixCodeASSISTANT_AUTOFIX_CODE
finding.assistant.guidance.instructionsASSISTANT_GUIDANCE_INSTRUCTIONS
finding.assistant.guidance.summaryASSISTANT_GUIDANCE_SUMMARY
finding.confidenceCONFIDENCE
finding.first_seen_scan_idFIRST_SEEN_SCAN_ID
finding.idUID
finding.location.columnSTART_COLUMN
finding.location.end_columnEND_COLUMN
finding.location.end_lineEND_LINE
finding.location.lineSTART_LINE
finding.match_based_idMATCH_BASED_ID
finding.refSOURCE_REF
finding.repository.nameTARGETS
finding.repository.urlREPOSITORY_URL
finding.relevant_sinceFIRST_FOUND
finding.rule.messageRULE_MESSAGE
finding.rule.nameTYPE
finding.sourcing_policy.asStringSOURCING_POLICY
finding.statusPROVIDER_STATUS
finding.syntactic_idSYNTACTIC_ID
finding.triage_commentTRIAGED_COMMENT
finding.triage_stateTRIAGE_STATE
finding.triaged_atLAST_FIXED, TRIAGED_AT
finding.assistant.autotriage.reasonASSISTANT_AUTOTRIAGE_REASON
finding.assistant.autotriage.verdictASSISTANT_AUTOTRIAGE_VERDICT
finding.assistant.component.riskASSISTANT_COMPONENT_RISK
finding.assistant.component.tagASSISTANT_COMPONENT_TAG
normalizeFindingStatus(finding.status)SOURCE_STATUS
Semgrep Static Code Finding Definition

Table 6: Semgrep Static Code Finding Definition attribute mappings

Semgrep Field NameSDM Attribute
finding.idNAME, UID
finding.rule.cweNamesCWE_IDS, WEAKNESSES
finding.rule.message.get(DESCRIPTION)DESCRIPTION
finding.rule.message.get(RECOMMENDATION)RECOMMENDATION
finding.severitySOURCE_SEVERITY
getFindingSeverityScore(finding.severity)SEVERITY_SCORE
normalizeFindingSeverity(finding.severity)SEVERITY

APIs​

The Semgrep connector uses the Semgrep Web API v1. Specifically, it uses the following endpoints:

Table 7: Semgrep API Endpoints

Connector ObjectAPI Endpoint
Semgrep Code ProjectGET /api/v1/deployments/{deploymentSlug}/projects
Semgrep Open Source FindingGET /api/v1/deployments/{deploymentSlug}/findings
Semgrep Open Source Finding DefinitionGET /api/v1/deployments/{deploymentSlug}/findings
Semgrep Static Code FindingGET /api/v1/deployments/{deploymentSlug}/findings
Semgrep Static Code Finding DefinitionGET /api/v1/deployments/{deploymentSlug}/findings

Changelog​

The Semgrep connector has undergone the following changes:

Table 8: Semgrep connector changelog

VersionDescriptionDate Published
3.0.4- Moved REACHABILITY and found dependency attributes from the Open Source Finding Definition to the Open Source Finding object.
- Moved assistant autotriage and component attributes from the Static Code Finding Definition to the Static Code Finding object.		February 11th, 2026
3.0.3Added new attributes for SAST and SCA findings in Open Source Finding, Open Source Finding Definition, Static Code Finding, and Static Code Finding Definition objects, including but not limited to FIX_RECOMMENDATIONS, REACHABLE_CONDITION, and REACHABILITY.February 4th, 2026
3.0.2- The connector now retrieves the Open Source Finding and Open Source Finding Definition objects from Semgrep, adding support for ingesting SCA findings.
- Updated several mappings on the Static Code Finding and Static Code Finding Definition objects.		September 26th, 2025
3.0.1- Fixed data type mismatches.
- Code cleanup and general maintenance.		August 29th, 2025
3.0.0Initial Integration+ release.January 23rd, 2023
Last updated on