Configure Checkmarx One ingestion

The Tenant (UI) is the primary channel for first-time onboarding, ad-hoc configuration changes, instance health verification, and triage of ingested findings.

Prerequisites

Before you begin, fulfill all requirements in Prerequisites.

Onboarding steps

The Checkmarx integration is configured through a wizard in the Cortex Cloud console. The wizard persists configuration so the wizard can be resumed if interrupted.

Step 1: Connect Checkmarx One

1. Navigate to Settings → Data Sources & Integrations → + Add New.
2. Search for Checkmarx, hover over the Checkmarx tile, and select Add or Add Another Instance.

Step 2: Configure integration

1. On the Connect Checkmarx One step, complete all fields (mandatory)based on your chosen authentication method.

   • If using an API key

     • API Key: The unique IAM string generated in the IAM portal
     • Region: The Checkmarx One regional base URL for the tenant. Refer to Reference A: Supported Checkmarx One regions
     • Tenant Name: The unique Checkmarx One tenant account name. Find it in Settings → Identity and Access Management or the administrator welcome email
   • If using an OAuth client

     • Client ID: The OAuth Client ID
     • Client Secret: The OAuth Client secret generated with the Client ID
     • Region: The Checkmarx One regional base URL
     • Tenant Name: The Checkmarx One tenant name

     Retrieve credentials from Settings → Identity and Access Management → OAuth Clients.
2. Select Authorize to validate the credentials against the Checkmarx One tenant.

Step 3: Select the finding type

1. On the Select Finding Type step of the integration wizard, select the type of data findings to ingest:

• SAST (pre-selected): Ingest Static Application Security Testing findings (Code Weaknesses
• SCA Ingest Software Composition Analysis findings (Vulnerabilities and license miscompliance)
• Both SAST and SCA

1. Select Next.

NOTE: You must select at least one scan type (SAST or SCA).

Step 4: Map repositories

Cortex Cloud detects Checkmarx projects available to the authenticated account and suggests a mapping to Cortex Cloud repositories. Only mapped projects are ingested. This mapping links Checkmarx projects to code repositories, simplifies access management, and enables repository-level risk analysis and tenant-wide findings visibility.

NOTE: A repository can only be associated with one project at a time.

On the Map Repositories step of the integration wizard, review the detected Checkmarx projects and confirm or manage the repository mappings.

1. Select one of the following mapping options:

   • Accept the detected (auto-suggested) mappings. Cortex Cloud pre-populates the Mapped Repository dropdown for projects it can match.
   • Automatically map future projects: Select Auto-map new repositories to automatically map current and future Checkmarx projects.
   • Manually map a project. For each project row, select a Mapped Repository, then select its branch in Set Branch.
   • Select Auto Map to map all currently unmapped projects.
   • Select Unmap all to clear current mappings before rerunning Auto Map.
2. Click Save.

Verify the integration

1. Navigate to Settings > Data Sources & Integrations and search for Checkmarx.
2. Hover over the resulting entry and select your instance.
3. Verify that the status of the Checkmarx instance is Connected and that the mapped projects status are listed as Connected. NOTE: Wait for the first ingestion polling cycle to complete. Initial ingestion latency depends on the number of mapped projects and the volume of historical findings in Checkmarx One.