> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/checkmarx/checkmarx-scanner-reference.md).

# Checkmarx step configuration

The Checkmarx step in Harness STO enables you to scan your code for security vulnerabilities, you can perform Checkmarx **CxSAST**, **CxSCA**, and **CxOSA** scanning in [Orchestration](#scan), [Ingestion](#scan) and [Extraction](#scan) modes of STO. This document will guide you through understanding the fields, configuring them, and providing any necessary information for setting up the step.

{% hint style="info" %}

* You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).
* STO supports three different approaches for loading self-signed certificates. For more information, refer [Run STO scans with custom SSL certificates](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/secure-sto-pipelines/ssl-setup-in-sto.md#supported-workflows-for-adding-custom-ssl-certificates).
  {% endhint %}

### Checkmarx step settings <a href="#checkmarx-step-settings" id="checkmarx-step-settings"></a>

The recommended workflow is to add a Checkmarx step to a **Security** or **Build** stage and then configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

* **Orchestration mode**: In this mode, the step executes the scan, then processes the results by normalizing and deduplicating them.
* **Ingestion mode**: In this mode, the Checkmarx step reads scan results from a data file, normalizes the data, and removes duplicates. It supports ingestion of results from any Checkmarx scanner that produces output in the [SARIF format](https://docs.oasis-open.org/sarif/sarif/v2.0/sarif-v2.0.html).
* **Extraction mode**: In this mode, the Checkmarx step retrieves scan results from the Checkmarx portal and stores them in STO. This mode is supported only for Checkmarx SAST (CxSAST).

**Scan Configuration**

* **SAST** or **Default** - Checkmarx Static Application Security Testing. Checkmarx step runs a SAST scan using the [CxConsole CLI](https://checkmarx.com/resource/documents/en/34965-8152-running-scans-from-the-cli.html)
* **CxSCA** - Checkmarx Software Composition Analysis
* **CxOSA** - Checkmarx Open Source Analysis

#### Target <a href="#target" id="target"></a>

**Type**

**Target and variant detection**

**Name**

**Variant**

**Workspace**

#### Ingestion File <a href="#ingestion-file" id="ingestion-file"></a>

#### Authentication <a href="#authentication" id="authentication"></a>

**Domain**

* For **Default** and **CxOSA** scan configurations, the domain URL must end with the `/cxrestapi` route.
* For **CxSCA** scan configuration, the domain should be set to `sca.checkmarx.net`.

**Enforce SSL**

**Access ID**

**Access Token**

#### Scan Tool <a href="#scan-tool" id="scan-tool"></a>

**Team Name**

The Checkmarx team name. Use the format `/<`*`server-name`*`>/<`*`team-name`*`>` — for example, `/server1.myorg.org/devOpsEast`. In some cases, your Checkmarx's Account or Tenet name may be used as the Team Name.

**Project Name**

If the specified project does not exist, the step will create a new project using the provided Project Name.

**Use Raw Scanner Severity**

#### Log Level <a href="#log-level" id="log-level"></a>

#### Additional CLI flags <a href="#additional-cli-flags" id="additional-cli-flags"></a>

Use this field to run the [Checkmarx plugin](https://checkmarx.com/resource/documents/en/34965-8152-running-scans-from-the-cli.html) with flags such as:

* `-incremental` — Run an [incremental scan](#running-incremental-scans-with-checkmarx).
* `-LocationPathExclude`— Exclude one or more paths from the scan.
* `-LocationFilesExclude` — Exclude one or more paths from the scan.
* `-OsaPathExclude` — Exclude matching paths from the scan.
* `-OsaFilesExclude` — Exclude matching files from the scan.
* `-C or -Comment`— Add a comment to the scan. This is useful for attaching metadata. When specified, the value is added under Issue Raw Details in the Issue Details view as a `CLI Comment`.

#### Running incremental scans with Checkmarx <a href="#running-incremental-scans-with-checkmarx" id="running-incremental-scans-with-checkmarx"></a>

In some cases, you might want to run an incremental rather than a full scan with Checkmarx due to time or licensing limits. An incremental scan evaluates only new or changed code in a merge or pull request. Incremental scans are faster than full scans, but become less accurate over time.

{% hint style="info" %}
Consider carefully when to run incremental vs. full scans. See [When should I use Incremental Scans vs Full Scans in CxSAST?](https://support.checkmarx.com/s/article/When-should-I-use-an) in the Checkmarx documentation.
{% endhint %}

**Fail on Severity**

#### Exclude issues marked as Not Exploited <a href="#exclude-issues-marked-as-not-exploited" id="exclude-issues-marked-as-not-exploited"></a>

You can configure the Checkmarx ingestion step to exclude issues detected by Checkmarx but flagged as Not Exploitable. To enable this setting, add the following key-value pair under **Settings**:

`hide_not_exploitable` : `True`

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

### Proxy settings <a href="#proxy-settings" id="proxy-settings"></a>