Troubleshooting

Symptom	Cause	Resolution
SARIF validation returns INVALID	The SARIF file does not conform to the SARIF 2.1.0 schema.	Verify the SARIF file structure against the SARIF format requirements. Ensure the runs[].tool.driver.name, runs[].results[], and runs[].results[].locations[] fields are present
SARIF validation returns PARTIALLY_VALID	The SARIF file is structurally valid but missing optional fields.	Review the validation warnings. Add missing optional fields (severity level, rule description, CWE tags) to improve finding quality. The file can be uploaded in the current state
Upload returns 401 Unauthorized	The collector credentials (Token ID or API Token) are invalid or expired.	Edit the collector in Settings → Data Sources → 3rd Party AppSec Collector to regenerate the API credentials. Update the credentials in the CI/CD pipeline configuration
Upload returns 400 Bad Request	The request body is not valid JSON or does not conform to the SARIF schema.	Validate the SARIF file using the validation endpoint before uploading. Ensure the Content-Type header is set to application/json
Findings do not appear after upload	The repository_id parameter does not match a valid Cortex Cloud repository asset.	Verify the repository asset ID in Inventories → All Assets → Application Security → Repositories. Ensure the repository is onboarded and active
Findings do not appear after upload	The branch parameter does not match the expected branch name.	Verify the branch name matches the branch naming convention used in the Cortex Cloud repository configuration
Findings appear but lack severity	The SARIF file does not include the level field in the results.	Add the level field (error, warning, note) to each result in the SARIF output. Configure the third-party tool to include severity information in the SARIF output
Findings appear but lack CWE classification	The SARIF file does not include CWE tags in the rule properties.	Add CWE identifiers (e.g., CWE-79) to the runs[].tool.driver.rules[].properties.tags[] array in the SARIF output
CI/CD pipeline fails after collector deletion	The deleted collector credentials are still referenced in the pipeline configuration.	Create a new collector instance, generate new credentials, and update the CI/CD pipeline configuration with the new credentials