Reference B: Checkmarx frequently asked questions

Can SAST and SCA be enabled for the same Checkmarx integration?

Yes. Both scan types can be enabled simultaneously on the Select Issue Types step of the integration wizard. SAST and SCA findings are ingested independently and surface in the Code Weaknesses and Vulnerabilities tables respectively, with the Data Source column set to Checkmarx.

Does the Checkmarx integration generate SBOM reports?

No. The Checkmarx integration creates software package assets and vulnerability findings from SCA ingestion, but does not generate formal SBOM documents in CycloneDX or SPDX format. Formal SBOM reports are only generated by the native Cortex Cloud SCA scanner during periodic repository scans.

Which vulnerability identifier is used when Checkmarx reports both a CVE and a Checkmarx-specific identifier?

CVE identifiers are prioritized. When a Checkmarx SCA finding contains both a CVE identifier (for example, CVE-2021-23337) and a Checkmarx-specific identifier, the CVE identifier is used as the primary vulnerability ID. If no CVE identifier is available, the Checkmarx identifier is used.

What happens if both Cortex Cloud native scanning and Checkmarx scan the same repository?

Both result sets appear in the issues tables and the Asset Inventory. Findings from each source are stored separately with the respective data-source label (Checkmarx vs. native scanner). Filter by Data Source to view findings from a specific tool. Issues that aggregate identical findings from multiple sources (for example, the same CVE detected by both Checkmarx and the native scanner) are deduplicated at the issue level while retaining per-source finding records.

Are SAST findings from Checkmarx linked to specific packages?

No. Checkmarx SAST findings are associated with the repository asset and reference specific source-code files and line numbers. Only Checkmarx SCA findings create software package assets.

How often are Checkmarx findings refreshed?

Findings are refreshed on the platform polling cycle and when a scan is triggered for the integration. Scans can be triggered by repository-mapping changes, integration updates, or scheduled orchestration scans.

Can multiple Checkmarx One tenants be connected?

Each Checkmarx integration instance connects to a single Checkmarx One tenant. To ingest findings from multiple Checkmarx One tenants, create a separate Checkmarx integration instance for each tenant by selecting Add Another Instance on the Data Sources & Integrations page.

Where do Checkmarx findings appear on the AppSec Coverage page?

The AppSec Coverage page displays a dedicated Checkmarx column that indicates which repositories have active Checkmarx scanning. The aggregate Vulnerabilities and Code Weaknesses columns reflect Checkmarx contributions to overall scanner coverage. For more information refer to AppSec Coverage.