> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/checkmarx/tenant-ui-workflow.md).

# Configure Checkmarx One ingestion

The Tenant (UI) is the primary channel for first-time onboarding, ad-hoc configuration changes, instance health verification, and triage of ingested findings.

## Prerequisites

Before you begin, fulfill all requirements in [Checkmarx](/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/checkmarx.md#prerequisites).

## Onboarding steps

The Checkmarx integration is configured through a wizard in the Cortex Cloud console. The wizard persists configuration so the wizard can be resumed if interrupted.

#### Step 1: Connect Checkmarx One

1. Navigate to **Settings** → **Data Sources & Integrations** → **+ Add New**.
2. Search for **Checkmarx**, hover over the Checkmarx tile, and select **Add** or **Add Another Instance**.

#### Step 2: Configure integration

1. On the **Connect Checkmarx One** step, complete all fields (mandatory)based on your chosen authentication method.
   * **If using an API key**
     * **API Key:** The unique IAM string generated in the IAM portal
     * **Region:** The Checkmarx One regional base URL for the tenant. Refer to [Reference A: Supported Checkmarx One regions](broken://spaces/8Z0RLJ1BFF5TQL8VtUeK/pages/WO8AlbD6nL5VqT3AHY4l)
     * **Tenant Name:** The unique Checkmarx One tenant account name. Find it in **Settings** → **Identity and Access Management** or the administrator welcome email
   * **If using an OAuth client**

     * **Client ID:** The OAuth Client ID
     * **Client Secret:** The OAuth Client secret generated with the Client ID
     * **Region:** The Checkmarx One regional base URL
     * **Tenant Name:** The Checkmarx One tenant name

     Retrieve credentials from **Settings** → **Identity and Access Management** → **OAuth Clients**.
2. Select **Authorize** to validate the credentials against the Checkmarx One tenant.

#### Step 3: Select the finding type

1. On the **Select Finding Type** step of the integration wizard, select the type of data findings to ingest:

* **SAST** (pre-selected): Ingest Static Application Security Testing findings (Code Weaknesses
* **SCA** Ingest Software Composition Analysis findings (Vulnerabilities and license miscompliance)
* Both SAST and SCA

2. Select **Next**.

> **NOTE:** You must select at least one scan type (SAST or SCA).

#### Step 4: Map repositories

Cortex Cloud detects Checkmarx projects available to the authenticated account and suggests a mapping to Cortex Cloud repositories. Only mapped projects are ingested. This mapping links Checkmarx projects to code repositories, simplifies access management, and enables repository-level risk analysis and tenant-wide findings visibility.

**NOTE**: A repository can only be associated with one project at a time.

On the **Map Repositories** step of the integration wizard, review the detected Checkmarx projects and confirm or manage the repository mappings.

1. Select one of the following mapping options:
   * **Accept the detected (auto-suggested) mappings**. Cortex Cloud pre-populates the **Mapped Repository** dropdown for projects it can match.
   * **Automatically map future projects:** Select **Auto-map new repositories** to automatically map current and future Checkmarx projects.
   * **Manually map a project**. For each project row, select a **Mapped Repository**, then select its branch in **Set Branch**.
   * Select **Auto Map** to map all currently unmapped projects.
   * Select **Unmap all** to clear current mappings before rerunning **Auto Map**.
2. Click **Save**.

## Verify the integration

1. Navigate to **Settings** > **Data Sources & Integrations** and search for **Checkmarx**.
2. Hover over the resulting entry and select your instance.
3. Verify that the status of the Checkmarx instance is **Connected** and that the mapped projects status are listed as **Connected**.\
   NOTE: Wait for the first ingestion polling cycle to complete. Initial ingestion latency depends on the number of mapped projects and the volume of historical findings in Checkmarx One.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources/checkmarx/tenant-ui-workflow.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.