> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/ingest-third-party-sca-data.md).

# Ingest third-party SCA data

Currently, Cortex Cloud Application Security supports automated Software Composition Analysis (SCA) data ingestion from Semgrep, Snyk and Checkmarx. This integration enables automated ingestion of third-party scan results into Cortex Cloud, where they appear alongside findings from native Cortex scanners.

**Key benefits**

* **Centralizing findings:** Third-party SCA findings are normalized into the same data model as native Cortex vulnerability findings, enabling unified triage, policy enforcement, and reporting
* **Risk-based prioritization:** Ingested SCA findings inherit the Cortex Cloud risk prioritization framework. Each finding is enriched with CVSS scores, EPSS scores, risk factor labels, and contextual prioritization tags, enabling practitioners to focus on the most exploitable and business-critical vulnerabilities first
* **Extending Coverage visibility:** The AppSec Coverage page displays dedicated columns that indicate which repositories have third-party scanning enabled (for example, identifying repositories actively scanned by Semgrep or Snyk)
* **Enabling policy enforcement:** Ingested SCA findings are evaluated against Application Security policies, enabling block actions on PRs and CI pipelines based on vulnerabilities detected by your external tools

**View and manage SCA issues generated from ingested findings**

Issues generated from third-party findings are displayed directly within the main Vulnerabilities issues table. To view and manage these vulnerabilities to assess risk:

1. Navigate to **Modules** → **Application Security** → **Issues** → **Vulnerabilities**.
2. The table displays all vulnerability issues across all data sources, combining native and third-party results.

To identify the specific third-party origin of an issue or finding, use one of the following methods:

* **Identify origin in the issue side panel**: Open any vulnerability issue by selecting the row. In the issue side panel, locate the Scanner field in the impact fields section, which identifies the originating scanner (such as Semgrep, Snyk, Checkmarx)
* **Identify origin from the Findings tab**: Switch to the Findings tab (using the control at the top of the Vulnerabilities page). Filter the Data Source column by your vendor (such as SEMGREP) to isolate findings originating from that tool
* Filter the **Semgrep** / **Snyk** / **Checkmarx** column (using the values `is_scanned_by_semgrep, is_scanned_by_snyk, is_scanned_by_Checkmarx`) by **ENABLED** to identify repositories with active Semgrep/Snyk scanning. Select a repository to drill down into its associated issues

**SCA Ingestion FAQs**

**Do third-party integrations generate SBOM reports?**

No. Third-party SCA integrations create vulnerability findings, but they do not generate formal SBOM documents (CycloneDX/SPDX). Formal SBOM reports are only generated by the native Cortex Cloud SCA scanner during periodic repository scans


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/ingest-third-party-sca-data.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.