Custom Ingest step for SARIF and JSON scan results

Ingest SARIF or JSON scan results.

The Custom Ingest step enables you to ingest results from any third-party scanner. Harness STO supports two generic data formats:

• SARIF is an open data format supported by many scan tools, especially tools available as GitHub Actions. You can easily ingest SARIF 2.1.0 data from any tool that supports this format. If your scanner can export to SARIF, use this format. For more information, go to Ingest SARIF results.

• Harness STO supports a custom JSON format that's useful for ingesting data from scanners that currently have no integration in STO and that cannot publish to SARIF. For more information, go to Ingest Results from Unsupported Scanners.

The Custom Ingest step is intended for scanners that have no supported integration in STO. Harness recommends that you always use the documented workflow for supported scanners. For a list of all STO-supported scanners, go to Supported Scanners.

For more information

Custom Ingest step settings for STO scans

Scan

Scan mode

Scan Configuration

Target

Type

The target type of the scanned object. You can ingest data for the following target types:

• Repository Ingest scan results for a code repo.

• Container image Ingest scan results for the layers, libraries, and packages in a container image.

• Instance Ingest scan results for a running application.

• Configuration Ingest scan results for your cloud environment, generated by gathering configuration data via the cloud provider's APIs.

Name

Variant

Ingestion

Ingestion File

Log Level, CLI flags, and Fail on Severity

Log Level

Additional CLI flags

Fail on Severity

Additional Configuration

Advanced settings

Proxy settings

Custom Ingest pipeline examples

Here are some topics that describe end-to-end workflows for ingesting SARIF and JSON data:

• Gitleaks step configuration

• Checkmarx step configuration

• Run scans using GitHub Action and Drone Plugin steps

• Ingest JSON results from custom or unsupported scanners