Checkmarx step configuration

Scan code repositories with Checkmarx.

The Checkmarx step in Harness STO enables you to scan your code for security vulnerabilities, you can perform Checkmarx CxSAST, CxSCA, and CxOSA scanning in Orchestration, Ingestion and Extraction modes of STO. This document will guide you through understanding the fields, configuring them, and providing any necessary information for setting up the step.

• You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer Configure your pipeline to use STO images from private registry.

• STO supports three different approaches for loading self-signed certificates. For more information, refer Run STO scans with custom SSL certificates.

Checkmarx step settings

The recommended workflow is to add a Checkmarx step to a Security or Build stage and then configure it as described below.

Scan

Scan Mode

• Orchestration mode: In this mode, the step executes the scan, then processes the results by normalizing and deduplicating them.

• Ingestion mode: In this mode, the Checkmarx step reads scan results from a data file, normalizes the data, and removes duplicates. It supports ingestion of results from any Checkmarx scanner that produces output in the SARIF format.

• Extraction mode: In this mode, the Checkmarx step retrieves scan results from the Checkmarx portal and stores them in STO. This mode is supported only for Checkmarx SAST (CxSAST).

Scan Configuration

• SAST or Default - Checkmarx Static Application Security Testing. Checkmarx step runs a SAST scan using the CxConsole CLI

• CxSCA - Checkmarx Software Composition Analysis

• CxOSA - Checkmarx Open Source Analysis

Target

Type

Target and variant detection

Name

Variant

Workspace

Ingestion File

Authentication

Domain

• For Default and CxOSA scan configurations, the domain URL must end with the /cxrestapi route.

• For CxSCA scan configuration, the domain should be set to sca.checkmarx.net.

Enforce SSL

Access ID

Access Token

Scan Tool

Team Name

The Checkmarx team name. Use the format /<server-name>/<team-name> — for example, /server1.myorg.org/devOpsEast. In some cases, your Checkmarx's Account or Tenet name may be used as the Team Name.

Project Name

If the specified project does not exist, the step will create a new project using the provided Project Name.

Use Raw Scanner Severity

Log Level

Additional CLI flags

Use this field to run the Checkmarx plugin with flags such as:

• -incremental — Run an incremental scan.

• -LocationPathExclude— Exclude one or more paths from the scan.

• -LocationFilesExclude — Exclude one or more paths from the scan.

• -OsaPathExclude — Exclude matching paths from the scan.

• -OsaFilesExclude — Exclude matching files from the scan.

• -C or -Comment— Add a comment to the scan. This is useful for attaching metadata. When specified, the value is added under Issue Raw Details in the Issue Details view as a CLI Comment.

Running incremental scans with Checkmarx

In some cases, you might want to run an incremental rather than a full scan with Checkmarx due to time or licensing limits. An incremental scan evaluates only new or changed code in a merge or pull request. Incremental scans are faster than full scans, but become less accurate over time.

Consider carefully when to run incremental vs. full scans. See When should I use Incremental Scans vs Full Scans in CxSAST? in the Checkmarx documentation.

Fail on Severity

Exclude issues marked as Not Exploited

You can configure the Checkmarx ingestion step to exclude issues detected by Checkmarx but flagged as Not Exploitable. To enable this setting, add the following key-value pair under Settings:

hide_not_exploitable : True

Additional Configuration

Advanced settings

Proxy settings