Generic 3rd Party AppSec Collector
Streamline security by ingesting SARIF findings from any tool into Cortex Cloud. Achieve unified visibility and risk-based prioritization for all AppSec scans.
The 3rd Party AppSec Collector is a generic ingestion mechanism that enables Cortex Cloud Application Security to receive SAST findings from any security tool that produces SARIF (Static Analysis Results Interchange Format) output. The collector normalizes third-party findings into the unified Cortex Cloud data model, making the findings indistinguishable from native scanner findings in terms of triage, policy enforcement, and reporting.
Prerequisites
Prerequisite
Description
Cortex Cloud license
Base license: An active Cortex Cloud license with an Application Security add on
RBAC permissions
Data Source View\Edit permission is required to access the Data Sources page and view collector instances
Standard RBAC permissions for AppSec data source creation are required. Users with the AppSec Admin role have these permissions by default
To view findings, the Application Security Issues View permission is required
SBAC scope
Findings ingested into repositories outside the user's SBAC scope are not visible to the user in the Code Weaknesses table
Onboarded repositories
Target repositories must be onboarded in Cortex Cloud before ingestion. Ingestion requests must include a valid repository_id or repository_url. Findings with unresolvable identifiers are rejected
SARIF file format
A valid SARIF v2.1.0 file generated by the third-party SAST tool
SARIF requirements and mappings
Before implementing workflows, ensure your data meets the standards defined in
These references includes critical details on System requirements, SARIF format and mapping, and Repository mapping.
Recommended initial configuration
Set up the collector through the tenant to generate credentials, then integrate the collector into a CI/CD pipeline for automated, recurring ingestion. CI/CD integration is the primary shift-left use case. Automated ingestion at the CI stage ensures findings are captured continuously without manual intervention.
Use Upload findings from CI/CD pipelines to add collector uploads to GitHub Actions, GitLab CI, or Jenkins.
Manage integration instances
Manage administration channels, credential rotation, and integration deletion in Third-party integrations lifecycle administration and automation.
Manage ingested findings
Investigate findings, prioritize issues, remediate risks, and enforce policies in Manage the third-party data lifecycle.
Next step
Last updated
Was this helpful?