Semgrep

Semgrep is a code analysis tool that scans code to find and fix security vulnerabilities, bugs, and style issues in your organization's codebase. You can bring analysis data from Semgrep into Brinqa to prioritize and track the remediation efforts of those potential code issues to gain a unified view of your attack surface and strengthen your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with Semgrep and how to obtain that information from Semgrep. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings

When setting up a data integration, select Semgrep from the Connector drop-down. If you cannot find the connector in the drop-down, make sure that you have installed it first. You must provide the following information to authenticate Semgrep with Brinqa:

API URL: The Semgrep API URL. The default URL is https://semgrep.dev.
Access Token: The access token associated with the Semgrep account, which must have permissions to log in to the API server and return data.

note
The Semgrep account must be a Team or Enterprise tier account in order for the Semgrep connector to make API calls and return data.

Create a Semgrep access token

For the Semgrep connector to use the Semgrep Web API, you must provide an access token. Semgrep does not allow retrieving the access token for an existing user, therefore, you must generate a new access token instead. To do so, follow these steps:

Log in to the Semgrep application at https://semgrep.dev/login.
Navigate to Settings and click Tokens.
Click API tokens and then click Create new token.
The Create a token window appears with the new token. Give the token a name or leave it as is.

You cannot view the token after this. Copy the access token (Secrets value) and save it to a secure location.
Under Token scopes, select Web API. This ensures that the Semgrep connector pulls information from the Semgrep Web API.
Click Save.

note

The above steps describe the minimum requirements for the Semgrep connector to work properly with Brinqa. For additional information, see Semgrep documentation.

Additional settings

The Semgrep connector contains additional options for specific configuration:

Parallel requests: The maximum number of parallel API requests. The default setting is 4.
Maximum retries: The maximum number of times that the integration attempts to connect to the Semgrep API before giving up and reporting a failure. The default setting is 10.

Types of data to retrieve

The Semgrep connector can retrieve the following types of data from the Semgrep API:

Table 1: Data retrieved from Semgrep

Connector Object	Required	Maps to Data Model
Semgrep Code Project	Yes	Code Project
Semgrep Open Source Finding	Yes	Open Source Finding
Semgrep Open Source Finding Definition	Yes	Open Source Finding Definition
Semgrep Static Code Finding	Yes	Static Code Finding
Semgrep Static Code Finding Definition	Yes	Static Code Finding Definition

info

The Semgrep connector does not currently support operation options for the types of data it retrieves.

For detailed steps on how to view the data retrieved from Semgrep in the Brinqa Platform, see How to view your data.

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes.

Semgrep Code Project

Table 2: Semgrep Code Project Attribute Mappings

Semgrep Field Name	Maps to Brinqa Attribute
active	status
project.categories	categories
project.name	name
project.name	uid
project.tags	tags
project.url	url

Semgrep Open Source Finding

Table 3: Semgrep Open Source Finding Attribute Mappings

Semgrep Field Name	Maps to Brinqa Attribute
buildPath(finding.location)	path
finding.confidence	confidence
finding.first_seen_scan_id	firstSeenScanId
finding.id	uid
finding.location.column	startColumn
finding.location.line	startLine
finding.location.endColumn	endColumn
finding.location.endLine	endLine
finding.match_based_id	matchBasedId
finding.ref	sourceRef
finding.repository.name	targets
finding.repository.url	repositoryUrl
finding.relevant_since	firstFound
finding.rule.cweNames	cweIds
finding.rule.message	ruleMessage
finding.rule.name	type
finding.status	providerStatus
finding.status	sourceStatus
finding.syntactic_id	syntacticId
finding.triage_comment	triagedComment
finding.triage_state	triageState
finding.triaged_at	lastFixed
finding.triaged_at	triagedAt
normalizeFindingStatus(finding.status)	sourceStatus
rule.cweNames	weaknesses

Semgrep Open Source Finding Definition

Table 4: Semgrep Open Source Finding Definition Attribute Mappings

Semgrep Field Name	Maps to Brinqa Attribute
finding.fix_recommendations.each → packageName + " : " + version	fixRecommendations
finding.id	name, uid
finding.rule.cweNames	cweIds, weaknesses
finding.rule.message.get(DESCRIPTION)	description
finding.rule.message.get(RECOMMENDATION)	recommendation
finding.severity	sourceSeverity
finding.vulnerability_identifier	cveIds
getFindingSeverityScore(finding.severity)	severityScore
normalizeFindingSeverity(finding.severity)	severity

Semgrep Static Code Finding

Table 5: Semgrep Static Code Finding attribute mappings

Semgrep Field Name	Maps to Brinqa Attribute
buildPath(finding.location)	path
finding.confidence	confidence
finding.first_seen_scan_id	firstSeenScanId
finding.id	uid
finding.location.column	startColumn
finding.location.end_column	endColumn
finding.location.end_line	endLine
finding.location.line	startLine
finding.match_based_id	matchBasedId
finding.ref	sourceRef
finding.repository.name	targets
finding.repository.url	repositoryUrl
finding.relevant_since	firstFound
finding.rule.message	ruleMessage
finding.rule.name	type
finding.sourcing_policy.asString	sourcingPolicy
finding.status	providerStatus
finding.syntactic_id	syntacticId
finding.triage_comment	triagedComment
finding.triage_state	triageState
finding.triaged_at	lastFixed, triagedAt
normalizeFindingStatus(finding.status)	sourceStatus

Semgrep Static Code Finding Definition

Table 6: Semgrep Static Code Finding Definition attribute mappings

Semgrep Field Name	Maps to Brinqa Attribute
finding.id	name, uid
finding.rule.cweNames	cweIds, weaknesses
finding.rule.message.get(DESCRIPTION)	description
finding.rule.message.get(RECOMMENDATION)	recommendation
finding.severity	sourceSeverity
getFindingSeverityScore(finding.severity)	severityScore
normalizeFindingSeverity(finding.severity)	severity

APIs

The Semgrep connector uses the Semgrep Web API v1. Specifically, it uses the following endpoints:

Table 7: Semgrep API Endpoints

Connector Object	API Endpoint
Semgrep Code Project	`GET /api/v1/deployments/{deploymentSlug}/projects`
Semgrep Open Source Finding	`GET /api/v1/deployments/{deploymentSlug}/findings`
Semgrep Open Source Finding Definition	`GET /api/v1/deployments/{deploymentSlug}/findings`
Semgrep Static Code Finding	`GET /api/v1/deployments/{deploymentSlug}/findings`
Semgrep Static Code Finding Definition	`GET /api/v1/deployments/{deploymentSlug}/findings`

Changelog

The Semgrep connector has undergone the following changes:

Table 8: Semgrep connector changelog

Version	Description	Date Published
3.0.2	- The connector now retrieves the Open Source Finding and Open Source Finding Definition objects from Semgrep, adding support for ingesting SCA findings. - Updated several mappings on the Static Code Finding and Static Code Finding Definition objects.	September 26th, 2025
3.0.1	- Fixed data type mismatches. - Code cleanup and general maintenance.	August 29th, 2025
3.0.0	Initial Integration+ release.	January 23rd, 2023

Required connection settings​

Create a Semgrep access token​

Additional settings​

Types of data to retrieve​

Attribute mappings​

APIs​

Changelog​