Checkmarx One Integration with DefectDojo
Checkmarx One Integration with DefectDojo
Checkmarx One is the cloud application security platform from Checkmarx. It brings several scanners under one project model, including static analysis (SAST), software composition analysis (SCA), and infrastructure as code scanning built on KICS, Checkmarx's open source IaC engine. Before Checkmarx One, many teams ran Checkmarx SAST (CxSAST) on their own servers, often with Checkmarx Open Source Analysis (CxOSA) for dependencies. Checkmarx also publishes CxFlow, a Spring Boot application that launches CxSAST scans and routes their results to bug trackers. DefectDojo can import Checkmarx One JSON exports, CxSAST XML reports, CxFlow JSON, and CxOSA JSON, and DefectDojo Pro adds a Checkmarx One connector.
Checkmarx One Integration with DefectDojo
We run Checkmarx One for code and dependency scanning, and DefectDojo is where its results meet everything else we test with. Pulling Checkmarx One findings into DefectDojo puts SAST, SCA, and IaC results on the same Asset as our DAST and container findings, carries over the triage state our developers already set in Checkmarx, and applies one set of SLAs across tools. For teams still on CxSAST or partway through a migration, the same Asset can hold both, so the history doesn't reset when the scanner does.
Why Checkmarx One Matters
Checkmarx is a common choice for organizations that need deep source code analysis across many languages, and Checkmarx One widens that to dependencies and infrastructure code.
- Its SAST engine traces data flow from source to sink, so findings show the path a tainted value takes through the code.
- SCA and IaC results come from the same scan and project, which keeps code, packages, and Terraform or Kubernetes manifests under one view in Checkmarx.
- Checkmarx's triage states (To Verify, Confirmed, Urgent, Not Exploitable, Proposed Not Exploitable) capture developer and AppSec decisions in the tool itself.
- Checkmarx reports cover what Checkmarx scans. Teams that also run DAST, cloud, or pentest programs still need one place to prioritize and report across all of it.
Advantages of This Integration
What we gained by routing Checkmarx results through DefectDojo:
- Triage state carries over. Checkmarx states map to DefectDojo's active, verified, and false positive flags, so work done in Checkmarx isn't repeated.
- Stable identity across scans. Checkmarx One findings deduplicate on the Checkmarx result ID, CxSAST detailed findings on the similarity and path IDs, and CxFlow findings on the similarity ID, file path, and line, so rescans update the same Findings.
- One lifecycle for SAST, SCA, and IaC. Reimporting mitigates results that disappeared, adds new ones, and reactivates regressions. Each Checkmarx One finding is tagged with its type (for example
sast,kics, orsca) for filtering. - Continuity through a migration. CxSAST and Checkmarx One results can live on the same Asset, which keeps SLA and closure history intact while teams move platforms.
- Branch-aware sync with DefectDojo Pro. The Checkmarx One connector can pin a branch, match branches by wildcard, or track each scanned branch in its own Engagement.
How This Integration Works
The row covers five sources. Use the scan type that matches the file.
Checkmarx One (Checkmarx One Scan). Export results as JSON from the Checkmarx One Results view, or with the Checkmarx One CLI:
cx results show --scan-id <scan-id> --report-format json --output-name cx_result --output-path .
The parser handles a top-level results array (with sast, kics, sca, and sca-container result types), a vulnerabilities array, and a sectioned layout with scanResults and iacScanResults. IaC findings from KICS arrive through this scan type.
Checkmarx SAST (Checkmarx Scan or Checkmarx Scan detailed). Generate an XML report from CxSAST. Checkmarx Scan aggregates results by CWE, severity, and sink file into one Finding with an occurrence count. Checkmarx Scan detailed keeps every data flow path as its own Finding with source and sink details. The Checkmarx Scan type also reads a JSON layout with sast, sca, and kics sections under scanResults.
CxFlow (Checkmarx CxFlow SAST). If CxFlow orchestrates your CxSAST scans, set its bug tracker to JSON (bug-tracker: Json in the cx-flow YAML section, or --cx-flow.bug-tracker=json on the command line). CxFlow then writes the scan results as a JSON file with an xissues array. Save it with a .json extension: the parser returns no findings for any other extension. Unlike the Checkmarx Scan type, this parser does not aggregate. Each data flow path in the report becomes its own Finding.
Checkmarx OSA (Checkmarx OSA). CxConsole writes OSA results as several JSON files. Combine the vulnerabilities and libraries files into one array before import:
jq -s . CxOSAVulnerabilities.json CxOSALibraries.json > cxosa.json
Import the file. In the UI, open the Engagement, choose Import Scan Results, pick the scan type, and upload. Via the API (Community Edition and DefectDojo Pro):
curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
-H "Authorization: Token $DD_API_TOKEN" \
-F "scan_type=Checkmarx One Scan" \
-F "file=@cx_result.json" \
-F "product_name=payments-api" \
-F "engagement_name=CI" \
-F "auto_create_context=true"
With Universal Importer (DefectDojo Pro):
universal-importer import \
--defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
--scan-type "Checkmarx Scan detailed" \
--report-path "./cxsast-report.xml" \
--product-name "payments-api" \
--engagement-name "CxSAST" \
--auto-create-context
Checkmarx One connector (DefectDojo Pro). Configure it in the DefectDojo Pro UI with your Checkmarx Tenant name, an API key, and your tenant Location (for example https://<region>.ast.checkmarx.net/, or https://ast.checkmarx.net for the primary US server). By default each sync imports the most recent completed scan of each project regardless of branch. Optional settings change that:
- Branch pins one branch name for all projects, and accepts
*wildcards such asrelease/*. - Track Scanned Branches imports the latest scan of every branch into its own Engagement, so a fix on one branch never closes another branch's findings.
- Result States limits imports to listed states, for example
CONFIRMED,URGENT. Not Exploitable findings are never imported. - Tag Findings With Scan ID adds a
scan-id:<id>tag so each finding can be located in Checkmarx.
Data Granularity: What Gets Imported
Checkmarx One Scan (results array):
| DefectDojo Field | Source in Checkmarx One JSON | Notes |
|---|---|---|
| Title / Description | description |
Falls back to severity plus query name when missing |
| Severity | severity |
Title-cased, for example HIGH becomes High |
| Active / Verified / False Positive | state |
To Verify, Proposed Not Exploitable, Confirmed, Urgent are active; Not Exploitable is a false positive |
| CWE | vulnerabilityDetails.cweId |
Numeric CWE |
| File Path | First node fileName (SAST), data.filename (KICS) |
Not set for SCA |
| Vulnerability IDs | cveId |
SCA results |
| Date | firstFoundAt |
First detection time |
| Tags | type |
sast, kics, sca, or sca-container |
| Deduplication | Unique ID from tool | Checkmarx id, falling back to similarityId |
Checkmarx Scan and Checkmarx Scan detailed (CxSAST XML):
| DefectDojo Field | Source in CxSAST XML | Notes |
|---|---|---|
| Title | Query name and sink file name |
Query name made readable, sink file in parentheses |
| Severity / CWE | Result Severity, Query cweId |
Taken as reported |
| Description | Category, language, group, status, deep link, path nodes | Detailed mode lists every node with code snippets |
| File Path / Line | Last path node | Line set in detailed mode only |
| SAST Source and Sink | First and last path nodes | Detailed mode only |
| Active / Verified / False Positive | Result state, FalsePositive |
Same state model as Checkmarx One |
| Deduplication | Hashcode or unique ID | Simple: CWE, severity, file path. Detailed: SimilarityId plus PathId |
Checkmarx CxFlow SAST:
| DefectDojo Field | Source in CxFlow JSON | Notes |
|---|---|---|
| Title | vulnerability and sink file name |
Query name made readable (_ becomes a space) |
| Severity / CWE | Issue severity, cwe |
Taken as reported |
| Description | Categories, language, status, link, description, snippets | Includes source and sink code snippets |
| File Path / Line | Issue filename, sink line |
One Finding per entry in details |
| SAST Source and Sink | Result source and sink |
Object, source file path, and source line |
| Date | scanStartDate |
From the report's additional details |
| Active / Verified / False Positive | Result state, detail falsePositive |
Same state model as Checkmarx One |
| Vulnerability ID from tool | similarityId |
Checkmarx similarity ID |
| Deduplication | Hashcode | Vulnerability ID from tool, file path, line |
Checkmarx OSA:
| DefectDojo Field | Source in CxOSA JSON | Notes |
|---|---|---|
| Title | Library name, version, cveName |
Library and version followed by the CVE |
| Severity / CVSS | severity.name, score |
Score stored as CVSS v3 score |
| Component | Library name, version |
|
| Mitigation / References | recommendations, url |
|
| CWE | Fixed at 1035 | Using Components with Known Vulnerabilities |
| Scanner Confidence | Library confidenceLevel |
Converted from percentage |
| Deduplication | Unique ID or hashcode | Checkmarx ID, or vulnerability IDs plus component name |
All Checkmarx findings are marked static. CxSAST imports also record the languages found on the Asset.
Use Cases
CI pipelines on Checkmarx One: A pipeline runs the Checkmarx One scan, exports JSON with the CLI, and reimports into the branch's Test. Developers keep triaging in Checkmarx, and DefectDojo reflects their decisions on the next import.
Migrating from CxSAST: A team moving from on-premises CxSAST imports historic XML reports into the same Assets that will later receive Checkmarx One results, so SLA metrics and closure history carry through the change.
Many branches with DefectDojo Pro: An organization scanning feature and release branches enables Track Scanned Branches. Each branch gets its own Engagement, and release branch findings aren't closed by fixes on main.
Infrastructure reviews: Platform teams filter on the kics or iac tag to see Terraform and Kubernetes misconfigurations for an Asset separately from code findings.
Operational Tips
- If CxFlow already runs your CxSAST scans, import its JSON with Checkmarx CxFlow SAST rather than exporting a separate XML report. Its similarity ID, file, and line hash stays stable when description text changes. Don't mix it with Checkmarx Scan imports in the same Test.
- Pick Checkmarx Scan detailed for CxSAST if you need line numbers and per-path tracking. The simple mode groups paths per sink file, which is quieter but less precise.
- Prefer the
resultsarray JSON for Checkmarx One. In the sectionedscanResultslayout, SCA packages are not parsed and findings carry no Checkmarx ID. - Keep one scan type per Test. Simple and detailed CxSAST modes, or file imports and connector syncs, use different identities and won't deduplicate against each other.
- Use Result States on the connector to import only Confirmed and Urgent findings if your developers triage in Checkmarx first.
- Remember that Not Exploitable findings import as inactive false positives from files, so they stay visible for audit without counting against SLAs.
- Tag imports with the branch (for example
tags=main) when you aren't using connector branch tracking.