> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/continuous-delivery/use-continuous-delivery/cd-building-blocks/cd-steps/containerized-steps/sto-ingest-step.md).

# Custom Ingest step

Ingest third-party scanner results into a Continuous Delivery stage using SARIF or custom JSON

The Custom Ingest step ingests results from any third-party scanner. Harness Security Testing Orchestration (STO) supports two generic data formats:

* [SARIF](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html) (Static Analysis Results Interchange Format) is an open data format supported by many scan tools, especially tools available as GitHub Actions. You can ingest SARIF 2.1.0 data from any tool that supports this format. If your scanner can export to SARIF, use this format. Go to [Ingest SARIF scan results](https://developer.harness.io/docs/security-testing-orchestration/custom-scanning/ingest-sarif-data/) to configure SARIF ingestion.
* Harness STO supports a custom JSON format that is useful for ingesting data from scanners that have no integration in STO and that cannot publish to SARIF. Go to [Ingest results from unsupported scanners](https://developer.harness.io/docs/security-testing-orchestration/custom-scanning/ingesting-issues-from-other-scanners/) to configure JSON ingestion.

{% hint style="info" %}
**Use a supported scanner when one exists**

The Custom Ingest step is intended for scanners that have no supported integration in STO. Use the documented workflow for supported scanners. Go to [Supported Security Scanners](https://developer.harness.io/docs/security-testing-orchestration/whats-supported/scanners/) for the list of scanners STO supports.
{% endhint %}

***

## What you will learn from this topic

* How to choose [SARIF or custom JSON](#custom-ingest-step) for a scanner that STO does not integrate directly
* How to find the [step settings](#custom-ingest-step-settings-for-sto-scans) for scan, target, and ingestion
* How to open an [ingestion workflow](#custom-ingest-pipeline-examples) for SARIF or JSON results
* How to read a [sample pipeline](#sample-pipeline) that writes a JSON results file and ingests it

***

## Before you begin

Review the following before you add a Custom Ingest step:

* **Containerized step group**: The sample pipeline runs the step inside a step group on Kubernetes. Go to [Containerize step groups](/continuous-delivery/use-continuous-delivery/cd-building-blocks/cd-steps/containerized-steps/containerized-step-groups.md) to enable container-based execution.
* **Supported scanners**: Go to [Supported Security Scanners](https://developer.harness.io/docs/security-testing-orchestration/whats-supported/scanners/) and use a dedicated scanner step when STO already supports the scanner.
* **Result file**: The step reads a SARIF or custom JSON file. Go to [Ingest SARIF scan results](https://developer.harness.io/docs/security-testing-orchestration/custom-scanning/ingest-sarif-data/) or [Ingest results from unsupported scanners](https://developer.harness.io/docs/security-testing-orchestration/custom-scanning/ingesting-issues-from-other-scanners/) to prepare that file.

***

## Related resources <a href="#related-resources" id="related-resources"></a>

The following topics cover scanner setup in Security Testing Orchestration:

* [What's supported in STO](https://developer.harness.io/docs/security-testing-orchestration/whats-supported/sto-deployments/)
* [Security Testing Orchestration FAQs](https://developer.harness.io/docs/security-testing-orchestration/faqs/)
* [Optimize STO pipelines](https://developer.harness.io/docs/security-testing-orchestration/use-sto/set-up-sto-pipelines/optimize-sto-pipelines/)

***

## Custom Ingest step settings for STO scans <a href="#custom-ingest-step-settings-for-sto-scans" id="custom-ingest-step-settings-for-sto-scans"></a>

The step settings are grouped below. This topic lists the setting names. Go to [Custom Ingest step for SARIF and JSON scan results](https://developer.harness.io/docs/security-testing-orchestration/custom-scanning/custom-ingest-reference/) for the field descriptions maintained with the Security Testing Orchestration step reference.

### Scan <a href="#scan" id="scan"></a>

The scan settings on this step are:

* **Scan mode**
* **Scan Configuration**

### Target <a href="#target" id="target"></a>

**Type**

The target type of the scanned object. You can ingest data for the following target types:

* **Repository**: Ingest scan results for a code repository.
* **Container image**: Ingest scan results for the layers, libraries, and packages in a container image.
* **Instance**: Ingest scan results for a running application.
* **Configuration**: Ingest scan results for your cloud environment, generated by gathering configuration data through the cloud provider's APIs.

**Name**

**Variant**

### Ingestion <a href="#ingestion" id="ingestion"></a>

The ingestion setting on this step is **Ingestion File**.

### Log Level, CLI flags, and Fail on Severity <a href="#log-level-cli-flags-and-fail-on-severity" id="log-level-cli-flags-and-fail-on-severity"></a>

The log and failure settings on this step are:

* **Log Level**
* **Additional CLI flags**
* **Fail on Severity**

### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

Go to [Custom Ingest step for SARIF and JSON scan results](https://developer.harness.io/docs/security-testing-orchestration/custom-scanning/custom-ingest-reference/#additional-configuration) for the fields under **Additional Configuration**.

### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

Go to [Custom Ingest step for SARIF and JSON scan results](https://developer.harness.io/docs/security-testing-orchestration/custom-scanning/custom-ingest-reference/#advanced-settings) for **Conditional Execution**, **Failure Strategy**, **Looping Strategy**, and **Policy Enforcement**.

***

## Proxy settings <a href="#proxy-settings" id="proxy-settings"></a>

Go to [Custom Ingest step for SARIF and JSON scan results](https://developer.harness.io/docs/security-testing-orchestration/custom-scanning/custom-ingest-reference/#proxy-settings) for the proxy variables on this step.

***

## Custom Ingest pipeline examples <a href="#custom-ingest-pipeline-examples" id="custom-ingest-pipeline-examples"></a>

The following topics describe end-to-end workflows for ingesting SARIF and JSON data:

* [Gitleaks step configuration](https://developer.harness.io/docs/security-testing-orchestration/sto-techref-category/gitleaks-scanner-reference/)
* [Checkmarx step configuration](https://developer.harness.io/docs/security-testing-orchestration/sto-techref-category/checkmarx/checkmarx-scanner-reference/)
* [Run STO scans using GitHub Action and Drone Plugin steps](https://developer.harness.io/docs/security-testing-orchestration/use-sto/set-up-sto-pipelines/run-scans-using-github-actions/)
* [Ingest results from unsupported scanners](https://developer.harness.io/docs/security-testing-orchestration/custom-scanning/ingesting-issues-from-other-scanners/)

***

## Sample pipeline <a href="#sample-pipeline" id="sample-pipeline"></a>

The following pipeline writes a custom JSON results file in a Run step, then ingests that file with a Custom Ingest step:

<details>

<summary>Sample YAML</summary>

```yaml
pipeline:
  name: abc
  identifier: abc
  projectIdentifier: your_project_identifier
  orgIdentifier: your_org_identifier
  tags: {}
  stages:
    - stage:
        name: s1
        identifier: s1
        description: ""
        type: Deployment
        spec:
          deploymentType: Kubernetes
          service:
            serviceRef: your_service_identifier
          environment:
            environmentRef: your_environment_identifier
            deployToAll: false
            infrastructureDefinitions:
              - identifier: your_infrastructure_identifier
          execution:
            steps:
              - stepGroup:
                  name: sg1
                  identifier: sg1
                  steps:
                    - step:
                        type: Run
                        name: Run_1
                        identifier: Run_1
                        spec:
                          connectorRef: a
                          image: alpine
                          shell: Sh
                          command: |-
                            cat <<EOF >> example.json
                            {  
                               "meta":{  
                                  "key":[  
                                     "issueName",  
                                     "fileName"  
                                  ],  
                                  "subproduct":"MyCustomScanner"  
                               },  
                               "issues":[  
                                  {  
                                     "subproduct":"MyCustomScanTool",  
                                     "issueName":"Cross Site Scripting",  
                                     "issueDescription":"Lorem ipsum...",  
                                     "fileName":"homepage-jobs.php",  
                                     "remediationSteps":"Fix me fast.",  
                                     "risk":"high",  
                                     "severity":8,  
                                     "status":"open",  
                                     "referenceIdentifiers":[  
                                        {  
                                           "type":"cwe",  
                                           "id":"79"  
                                        }  
                                     ]  
                                  }  
                               ]  
                            }
                            EOF
                            ls
                            cat example.json
                    - step:
                        type: CustomIngest
                        name: CustomIngest_1
                        identifier: CustomIngest_1
                        spec:
                          mode: ingestion
                          config: default
                          target:
                            type: repository
                            detection: manual
                            name: external-scanner-test
                            variant: main
                          advanced:
                            log:
                              level: info
                          ingestion:
                            file: example.json
                  stepGroupInfra:
                    type: KubernetesDirect
                    spec:
                      connectorRef: your_k8s_connector
            rollbackSteps: []
        tags: {}
        failureStrategies:
          - onFailure:
              errors:
                - AllErrors
              action:
                type: StageRollback
```

</details>

***

## Next steps

* Go to [Ingest SARIF scan results](https://developer.harness.io/docs/security-testing-orchestration/custom-scanning/ingest-sarif-data/) to ingest SARIF 2.1.0 output.
* Go to [Ingest results from unsupported scanners](https://developer.harness.io/docs/security-testing-orchestration/custom-scanning/ingesting-issues-from-other-scanners/) to ingest the custom JSON format.
* Go to [Custom Ingest step for SARIF and JSON scan results](https://developer.harness.io/docs/security-testing-orchestration/custom-scanning/custom-ingest-reference/) for the field descriptions of the settings listed above.
* Go to [Containerize step groups](/continuous-delivery/use-continuous-delivery/cd-building-blocks/cd-steps/containerized-steps/containerized-step-groups.md) to run the step on your Kubernetes cluster.

{% @harness-feedback/feedback %}