SonarQube

Ingest SAST findings directly from SonarQube into Cortex Cloud Application Security. This allows you to use Cortex Cloud Application Security's analysis and visualization tools to identify critical vulnerabilities, prioritize remediation efforts, and improve your application code security. The findings enter the Code Weaknesses table with the same Urgency-based prioritization applied to every other scanner, eliminating the need to triage vulnerabilities in a separate vendor console.

Limitation

SonarQube multi-quality rules are not supported.

Select your onboarding path

SonarQube has three deployment shapes, and Cortex Cloud reaches each one differently. Select the onboarding path that matches your SonarQube deployment before you begin, because the connection inputs and the network path differ.

Onboarding path	Use when	Network path
SonarCloud (SaaS)	You use the cloud-hosted https://sonarcloud.io service	Direct internet path
SonarQube Server — Direct	You run a self-hosted SonarQube Server that is publicly reachable from Cortex Cloud	Direct internet path
SonarQube Server — via Transporter	You run an on-premises SonarQube Server that is not reachable from the internet	Routed through the Broker VM AppSec Transporter

When to Use a Transporter

If your self-hosted integration is not publicly accessible, you must use the Broker VM AppSec Transporter to bridge the connection. A direct connection to a private domain fails because Cortex Cloud cannot reach the on-premises host.

Whether you need a Transporter depends on your domain type:

• Private domains: Always use a Transporter. Make sure the Transporter has an AppSec applet enabled so it appears in the onboarding wizard
• Public domains: No Transporter is needed. You will use an egress rule instead

For more information on Transporter, refer to Transporter over Broker VM.

Prerequisites

Verify the following before you begin. Common prerequisites apply to every onboarding path, and must be completed by all users, regardless of the chosen onboarding path. Path-specific prerequisites are additional requirements that apply only to a specific onboarding path.

Common prerequisites

Prerequisite	Description
Cortex Cloud license	An active Cortex Cloud license with Application Security add-on entitlements
RBAC roles and permissions	View/Edit permissions for Data Sources & Integrations RBAC: AppSec Admin or Instance Administrator
SonarQube API token	The API token for both SonarCloud and SonarQube (Self-Hosted) must be generated by a user with Organization Admin permissions The SonarQube API token must include Execute Analysis and Read permissions, which Cortex Cloud requires to list projects and pull findings Token scopes: When generating the SonarQube API token, you must assign the Web API. Refer to the SonarQube documentation for more information Generate the token in SonarQube from User > My Account > Security
SonarQube URL	The SonarQube or SonarCloud base URL. The URL must start with https://

Dedicated SonarCloud (SaaS) prerequisites

Prerequisite	Description
Organization key	The unique organization identifier parsed from your SonarCloud URL. Cortex Cloud rejects a SonarCloud integration that has no organization (for example, in [https://sonarcloud.io/organizations/acme-corp](https://sonarcloud.io/organizations/acme-corp), the key is acme-corp)

Common SonarQube Server prerequisites - Direct and via Transporter

• Egress path: Create an egress path to establish the designated route for outbound data transmission from Cortex Cloud to third party services. For more information about configuring egress paths, refer to Egress configurations.

Dedicated prerequisites for integration via Transporter

Require the following prerequisites when integrating through Transporter, In addition to the Common SonarQube Server prerequisites above.

Prerequisite	Description
Broker VM	A deployed Broker VM that can reach the on-premises SonarQube Server over the internal network
AppSec Transporter applet	The APP_SEC_TRANSPORTER applet activated on the Broker VM, with at least one enabled connection. NOTE: If this connection is missing or disabled, the integration will enter an invalid connection state
Reachable SonarQube Server	An on-premises SonarQube Server reachable from the Broker VM over https://

NOTE: For information on the Transporter over Broker VM solution, including setup, refer to Transporter over Broker VM.

Manage integration instances

Manage administration channels, credential rotation, and integration deletion in Third-party integrations lifecycle administration and automation.

Manage ingested findings

Investigate findings, prioritize issues, remediate risks, and enforce policies in Manage the third-party data lifecycle.

Next step

• Configure SonarQube ingestion