Checkmarx One step configuration

Scan code repositories, container and web instances with Checkmarx One.

The Checkmarx One step in Harness STO can help you perform code scanning, container image scanning and DAST for security vulnerabilities. It performs the following scans

• Static Application Security Testing (SAST) - Analyzes source code for security vulnerabilities.

• Secret Scanning - Detects hardcoded secrets in the codebase.

• Software Composition Analysis (SCA) — Scans dependencies and third-party libraries for vulnerabilities, including files related to container images in the repository.

• Infrastructure as Code (IaC) - Identifies security misconfigurations in IaC files.

• Container Scanning - Scan the layers, libraries, and packages in a container image.

• Instance Scanning - Scan a running application.

This document provides details to understand the step fields and configure them.

• You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer Configure your pipeline to use STO images from private registry.

• STO supports three different approaches for loading self-signed certificates. For more information, refer Run STO scans with custom SSL certificates.

Checkmarx One step settings

The recommended workflow is to add a Checkmarx One step to a Security or Build stage and then configure it as described below.

Scan

Scan Mode

Scan Configuration

Target

Type

Choose the Target Type to display and configure the relevant fields for that scan target.

Repository

Target and variant detection

Name

Variant

Workspace

Authentication

API Key

Access Token

Username and Password

Domain

Access ID

For Access ID, you can use an existing OAuth client in Checkmarx or create a new one and use its Client ID.

Access Token

For Access ID, you can use an existing OAuth client in Checkmarx or create a new one and use its Client Secret.

---

Ingestion File

This filed is visible when you are using Ingestion Scan Mode

Scan Tool

Project Name

If the specified project does not exist, the step will create a new project using the provided Project Name.

Use Raw Scanner Severity

Container Image

Target and variant detection

Name

Variant

Container Image

Type

Domain

Name

Tag/Digest

Access Id

Access Token

Authentication

API Key

Access Token

Username and Password

Domain

Access ID

For Access ID, you can use an existing OAuth client in Checkmarx or create a new one and use its Client ID.

Access Token

For Access ID, you can use an existing OAuth client in Checkmarx or create a new one and use its Client Secret.

---

Ingestion File

This filed is visible when you are using Ingestion Scan Mode

Scan Tool

Project Name

If the specified project does not exist, the step will create a new project using the provided Project Name.

Use Raw Scanner Severity

Instance

Target and variant detection

Name

Variant

Authentication

Domain

Access Token

---

Ingestion File

This filed is visible when you are using Ingestion Scan Mode

Scan Tool

Team Name

Enter your Checkmarx One Tenant Name. Provide the tenant name in the format /<server-name>/<team-name>. Example: /server1.myorg.org/devOpsEast

Project Name

Enter the project name to be scanned.

• If the specified project does not exist, the step creates a new project with the provided name.

• The provided Domain URL is configured as the project name if a new project is created.

Environment ID

Enter your Checkmarx One Environment ID. You can execute the step by entering only the existing Checkmarx One Environment ID without specifying any optional fields.

Scan Type

Select the scan type based on your use case:

• WEB: Select if scanning a web application.

• API: Select if scanning an API.

Context Name

Specify the Checkmarx context file to use for the scan.

• You must add the following shared path (Overview > Shared Paths) to your stage and copy your context file to this location: /shared/customer_artifacts/context/

Use Raw Scanner Severity

---

Log Level

Fail on Severity

Optional Settings

For repository scans, you can optionally add the following key value pairs to the Settings section of your Checkmarx One step. Harness STO uses these values to call the Checkmarx One API and retrieve repository scan metadata that is not exposed by the Checkmarx One CLI.

• product_domain: The regional IAM base URL for your Checkmarx One environment.

• product_team_name: Your Checkmarx One tenant name, also referred to as your account or organization name.

Exclude issues marked as Not Exploited

You can configure the CheckmarxOne ingestion step to exclude issues detected by CheckmarxOne but flagged as Not Exploitable. To enable this setting, add the following key-value pair under Settings:

hide_not_exploitable : True

Additional Configuration

Advanced settings

Proxy settings

View Checkmarx One issue state

Harness STO displays the Checkmarx One issue state, including custom states, in the Issue Details side panel for repository, container image, and instance scans.