Checkmarx

The Checkmarx integration automatically ingests Checkmarx One scan results into Cortex Cloud, normalizing and displaying them alongside native security findings. The integration supports both Static Application Security Testing (SAST) CWE-classified code weakness findings and Software Composition Analysis (SCA) CVE vulnerabilities and license miscompliance findings.

Each ingested finding is tagged with the originating data source so the finding can be filtered and traced back to Checkmarx.

Multi-channel workflows

The integration is managed across three channels: the Tenant (UI), the public REST API, and the Terraform provider. Ingested findings surface exclusively in the Tenant (UI).

For more information about workflow selection, see Third-party integrations lifecycle administration and automation.

Prerequisites

Before configuring the Checkmarx integration, verify the following:

Prerequisite	Description
Cortex Cloud license	A base Cortex Cloud license with the Application Security add-on
Cortex Cloud user permissions	View/Edit permissions for Data Sources and Integrations. RBAC role: AppSec Admin
Connected version control system (VCS)	A connected VCS (such as GitHub) and at least one onboarded repository
Checkmarx One tenant	An active Checkmarx One tenant with at least one project configured and scanned (SAST, SCA, or both, depending on which finding categories are to be ingested)
Checkmarx One credentials	The Checkmarx integration accepts either of these credential modes: OAuth Client (default): Client ID and Client Secret issued by Checkmarx One. This is the recommended production option when the administrator can create an OAuth client scoped to the tenant API Key: A Checkmarx One API key generated in the IAM portal. Use this when OAuth client credentials are not available
Checkmarx One permissions	Both credential modes require the ast-viewer capability to read projects and scan results. OAuth Client Role assignment: Manually map the ast-viewer and default-roles roles directly to the OAuth Client Scope assignment: Manually add the OAuth Client to the target Group, Team, or Tenant scope in Access Management. Otherwise, the API returns an empty list API Key Role assignment: No roles are assigned to the key. The generating user account must hold the ast-viewer role Scope assignment: The key inherits the generating user's Group and Team access Best practice: Generate the API key with a restricted service account, not an admin account
Checkmarx One tenant URL	The Checkmarx One regional base URL for the tenant. See the supported regions below
Egress path	A configured egress path that establishes the designated route for outbound data transmission from Checkmarx One to Cortex Cloud

Supported Checkmarx One regions

Use the hostname that matches your Checkmarx One tenant region.

Region (UI label)	Hostname
US	ast.checkmarx.net
US 2	us.ast.checkmarx.net
Germany	deu.ast.checkmarx.net
Europe	eu.ast.checkmarx.net
Europe 2	eu-2.ast.checkmarx.net
Australia	anz.ast.checkmarx.net
India	ind.ast.checkmarx.net
Singapore	sng.ast.checkmarx.net
United Arab Emirates	uae.ast.checkmarx.net

Manage integration instances

Manage administration channels, credential rotation, and integration deletion in Third-party integrations lifecycle administration and automation.

Manage ingested findings

Investigate findings, prioritize issues, remediate risks, and enforce policies in Manage the third-party data lifecycle.

Next step

• Configure Checkmarx One ingestion

Learn more

• Reference A: Checkmarx troubleshooting

• Reference B: Checkmarx frequently asked questions