Reference B: SARIF format and mapping

Required and optional SARIF fields for collector uploads.

The collector accepts SARIF 2.1.0 JSON files. Each file must conform to the SARIF 2.1.0 schema.

Required SARIF fields

Field	Path	Description
Tool name	runs[].tool.driver.name	Name of the tool that produced findings. Use this value as the collector name.
Rules	runs[].tool.driver.rules[]	Detection rule definitions. Each rule requires an id. Extensions may define rules in runs[].tool.extensions[].rules[].
Results	runs[].results[]	Individual findings. Each requires a ruleId, message, and location.
Rule ID	runs[].results[].ruleId	Must match an id in the driver or extension rules.
Message	runs[].results[].message.text	Human-readable finding description.
File URI	runs[].results[].locations[].physicalLocation.artifactLocation.uri	Relative path to the affected file.
Region	runs[].results[].locations[].physicalLocation.region	Location information. Include at least startLine.

Optional SARIF fields

Field	Path	Description
Severity level	runs[].results[].level	Finding severity: error, warning, note, or none.
Rule description	runs[].tool.driver.rules[].shortDescription.text	Short rule description. Also supported in extension rules.
Rule help	runs[].tool.driver.rules[].help.text	Rule remediation guidance. Also supported in extension rules.
Code snippet	runs[].results[].locations[].physicalLocation.region.snippet.text	Source snippet where the finding occurred.
End line	runs[].results[].locations[].physicalLocation.region.endLine	Last line in a multi-line finding.
CWE	runs[].tool.driver.rules[].properties.tags[]	CWE identifiers, such as CWE-79.
Rule properties	runs[].tool.driver.rules[].properties	Additional metadata, including tags and custom properties.