Checkmarx One
Connect Checkmarx One to RAD Security and query your projects, scans and SAST, SCA, IaC, secret and container findings in Checkmarx's own vocabulary.
RAD Security connects directly to the Checkmarx One API with an API key or an OAuth client and imports three data types: your projects, their completed scans, and the findings of each project's latest main-branch scan, from every scanner Checkmarx One runs: SAST, SCA (open-source dependencies), IaC (KICS), secret detection and containers.
The data keeps Checkmarx's vocabulary. A finding keeps Checkmarx's severity, triage state (TO_VERIFY, CONFIRMED, URGENT, NOT_EXPLOITABLE, ...) and occurrence status (NEW, RECURRENT), so a number in RAD and the same filter in the Checkmarx One console answer the same question.
Read-only integration. RAD exchanges the credentials for a short-lived token and only reads projects, scans and results. It never starts scans, changes a finding's state or writes comments in Checkmarx One.
Early access. This integration is enabled on request. Ask your RAD Security contact to turn it on for your workspace.
Prerequisites
- A Checkmarx One tenant (the cloud platform; the older self-hosted Checkmarx SAST / CxSAST is not supported)
- Your region and tenant name
- An API key, or an OAuth client, whose roles can view projects, scans and results
- A RAD Security workspace with integration permissions
What RAD stores
| Object | RAD data type | One row per | Refreshed |
|---|---|---|---|
| Projects | checkmarx_projects | project | every 4 hours |
| Scans | checkmarx_scans | completed scan | every 4 hours |
| Findings | checkmarx_findings | finding of a project (Checkmarx similarity id per scanner) | when the project's latest scan changes, and at least daily |
- Projects: name, groups, tags, repository URL, main branch, origin, application ids, and the scan the findings come from (
last_scan_id, branch, engines, created time) - Scans: project, branch, status, engines and each engine's outcome, source type and origin, initiator, tags
- Findings: scanner (
type),is_open, severity, state, status, first found / found / fixed times, title, description, query and query group, language, file and line (and the sink for SAST), package and recommended version, CVE, CWE, CVSS score, compliance frameworks, IaC platform with expected and actual values, container image and tag, and secret rule and validity
Secret-detection findings never carry the secret itself: RAD drops the code snippet from every secret result before it is stored.
The three types are queryable in the Evidence Room (External Data), dashboard widgets, the data API and radbot.
Step 1: Find your region and tenant
Region
The region is in the address you sign in at:
| Sign-in host | Region |
|---|---|
ast.checkmarx.net | us |
us.ast.checkmarx.net | us2 |
eu.ast.checkmarx.net | eu |
eu-2.ast.checkmarx.net | eu2 |
deu.ast.checkmarx.net | deu |
anz.ast.checkmarx.net | anz |
ind.ast.checkmarx.net | ind |
sng.ast.checkmarx.net | sng |
mea.ast.checkmarx.net | mea |
gov-il.ast.checkmarx.net | gov-il |
Tenant
The tenant name is what you enter on the Checkmarx One login page before your username.
Step 2: Create credentials
Open API keys
In Checkmarx One, open Identity and Access Management > API Keys.
Generate a key
Generate a key for RAD. It inherits the roles of the user who creates it, so create it as a user (ideally a service user) whose roles can view projects, scans and results, and nothing more.
Copy the key
Checkmarx One shows the key only once. Copy it before you close the dialog.
Checkmarx invalidates every API key when your Checkmarx One license changes (for example when a scanner is added). Generate a new key and update the integration when that happens.
Open OAuth clients
In Checkmarx One, open Identity and Access Management > OAuth Clients.
Create a client
Create a client for RAD and assign it roles that can view projects, scans and results.
Copy the client ID and secret
Copy both values.
Step 3: Configure in RAD Security
Open Data Sources > Integrations > AppSec, add Checkmarx One and fill in the fields.
| Field | Required | Value |
|---|---|---|
| Region | Yes | Your region from Step 1 |
| Tenant | Yes | Your tenant name |
| API key | One of the two | The API key from Step 2 |
| OAuth client ID and OAuth client secret | One of the two | Instead of an API key: the OAuth client from Step 2 |
RAD calls only the Checkmarx hosts of the region you pick. If both an API key and an OAuth client are entered, the API key is used.
What verification does
Saving the integration exchanges the credentials for a token and lists one project, which proves the credentials work in that region and tenant and can read what the sync reads. An API key generated on a different tenant or region is reported as such.
Once the status shows Connected, the first sync imports every project, its recent scans, and the findings of its latest main-branch scan. A large tenant is imported over several sync cycles.
Reading the data
Open is a column
A finding is open when is_open = 1: the project's latest main-branch scan reports it. When a later scan no longer reports it, RAD keeps the row with is_open = 0 and fixed_at set to when RAD first read that scan. Findings of a project deleted in Checkmarx One are closed the same way.
Which scan the findings come from
A project's findings come from its newest completed scan of the project's main branch. A project with no main branch set uses its newest completed scan of any branch. Feature-branch scans are stored in checkmarx_scans but do not open or close findings.
Triage changes
Changing a finding's state in Checkmarx One (for example to NOT_EXPLOITABLE) does not start a new scan. RAD re-reads every project's findings at least once a day, so a triage change appears in RAD within a day.
One row per finding
A finding's identity is the project, the scanner and Checkmarx's similarity id, which Checkmarx keeps stable across scans. The same issue found by consecutive scans is one row, updated in place; first_found_at and first_scan_id tell you when it first appeared.
Sync cadence
| What | Cadence |
|---|---|
| Projects and scans | every 4 hours |
| Findings of a project | when its latest main-branch scan changes, and at least once a day |
A sync cycle is bounded to about 20 minutes; a large tenant continues on the next cycle from the projects not yet checked. RAD paces its calls and backs off when Checkmarx One rate-limits the credentials.