The Custom Ingest step enables you to ingest results from any third-party scanner. Harness STO supports two generic data formats:
SARIF is an open data format supported by many scan tools, especially tools available as GitHub Actions. You can easily ingest SARIF 2.1.0 data from any tool that supports this format. If your scanner can export to SARIF, use this format. For more information, go to Ingest SARIF results.
Harness STO supports a custom JSON format that's useful for ingesting data from scanners that currently have no integration in STO and that cannot publish to SARIF. For more information, go to Ingest Results from Unsupported Scanners.
The Custom Ingest step is intended for scanners that have no supported integration in STO. Harness recommends that you always use the documented workflow for supported scanners. For a list of all STO-supported scanners, go to Security Step Settings Reference.
- Ingestion Ingestion scans are not orchestrated. The Security step ingest results from a previous scan (for a scan run in an previous step) and then normallizes and compresses the results.
The predefined configuration to use for the scan. All scan steps have at least one configuration.
The target type of the scanned object. You can ingest data for the following target types:
- Repository Ingest scan results for a code repo.
- Container image Ingest scan results for the layers, libraries, and packages in a container image.
- Instance Ingest scan results for a running application.
- Configuration Ingest scan results for your cloud environment, generated by gathering configuration data via the cloud provider's APIs.
The Identifier that you want to assign to the target you’re scanning in the pipeline. Use a unique, descriptive name such as
jsmith/myalphaservice. Using descriptive target names will make it much easier to navigate your scan data in the STO UI.
An identifier for a specific variant to scan, such as the branch name or image tag. This identifier is used to differentiate or group results for a target. Harness maintains a historical trend for each variant.
You can see the target name, type, and variant in the Test Targets UI:
The results data file to use when running an Ingestion scan.
Generally an Ingestion scan consists of a scan step (to generate the data file) and an ingestion step (to ingest the data file).
For more information, go to Ingest Scan Results into an STO Pipeline.
Log Level, CLI flags, and Fail on Severity
The minimum severity of the messages you want to include in your scan logs. You can specify one of the following:
Additional CLI flags
You can use this field to customize the scan with specific command-line arguments supported by that scanner.
Fail on Severity
Every Security step has a Fail on Severity setting. If the scan finds any vulnerability with the specified severity level or higher, the pipeline fails automatically. You can specify one of the following:
NONE— Do not fail on severity
The YAML definition looks like this:
fail_on_severity : critical # | high | medium | low | info | none
Custom Ingest pipeline examples
Here are some topics that describe end-to-end workflows for ingesting SARIF and JSON data: