Configure the Generic 3rd Party AppSec Collector

The Collector can be managed through the tenant for the full collector lifecycle, creation, credential generation, SARIF validation, editing, and deletion. Finding upload is performed exclusively through the API workflow.

Prerequisites

Fulfill the prerequisites stated in Generic 3rd Party AppSec Collector.

Onboarding steps

Step 1: Navigate to data sources

1. Navigate to Settings → Data Sources & Integrations.
2. Filter by Name = 3rd Party AppSec Collector.

   The Collector instances page displays all existing 3rd Party AppSec Collector instances.

Step 2: Create a collector

The collector creation wizard has three sequential steps.

Step 2a: Configure a collector

Define the collector identity and configuration.

1. Select + Add New or select Add Another Instance if a collector is displayed.
2. Enter a Collector Name (required). Set the collector name to match the tool.driver.name field from the SARIF file for consistent identification across the platform.

   Note: The collector name is the primary identifier for the collector instance. Use a descriptive name that identifies the third-party tool.
3. Select Generate API key.

Step 2b: Generate an API key

Copy the generated API credentials for use in the upload workflow.

1. Review the success message confirming the collector was created.
2. Copy the Token ID (first credential value), used as the x-crtx-auth-id header.
3. Copy the API Token (second credential value), used as the Authorization header.
4. Select Copy API URL to copy the collector-specific upload endpoint.
5. Optionally select View Examples to display cURL and Python upload examples.
6. Select Next.

Important

The Token ID and API Token are displayed only once. Copy and store the credentials securely before proceeding. If the credentials are lost, edit the collector to regenerate the credentials.

Step 2c: Validate the file format (optional)

Validate a SARIF file to verify the format before production use.

1. Upload a SARIF file using the file input.
2. Review the validation result. Values: Valid, Partially Valid, and Invalid. For definitions of each status, see Reference E: Validation statuses.
3. Select Done to complete the collector creation.

Validate a SARIF file (post-creation)

Validate a SARIF file against an existing collector instance without uploading findings.

1. Navigate to Settings → Data Sources → 3rd Party AppSec Collector.
2. Select the Test action for the collector instance.
3. Upload a SARIF file using the file input.
4. Review the validation result (VALID, PARTIALLY VALID, or INVALID). The validation panel displays the status and any issues detected.