> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/checkmarx/checkmarxone-scanner-reference.md).

# Checkmarx One step configuration

The Checkmarx One step in Harness STO can help you perform code scanning, container image scanning and DAST for security vulnerabilities. It performs the following scans

* **Static Application Security Testing (SAST)** - Analyzes source code for security vulnerabilities.
* **Secret Scanning** - Detects hardcoded secrets in the codebase.
* **Software Composition Analysis (SCA)** — Scans dependencies and third-party libraries for vulnerabilities, including files related to container images in the repository.
* **Infrastructure as Code (IaC)** - Identifies security misconfigurations in IaC files.
* **Container Scanning** - Scan the layers, libraries, and packages in a container image.
* **Instance Scanning** - Scan a running application.

This document provides details to understand the step fields and configure them.

{% hint style="info" %}

* You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).
* STO supports three different approaches for loading self-signed certificates. For more information, refer [Run STO scans with custom SSL certificates](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/secure-sto-pipelines/ssl-setup-in-sto.md#supported-workflows-for-adding-custom-ssl-certificates).
  {% endhint %}

### Checkmarx One step settings <a href="#checkmarx-one-step-settings" id="checkmarx-one-step-settings"></a>

The recommended workflow is to add a Checkmarx One step to a **Security** or **Build** stage and then configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

#### Target <a href="#target" id="target"></a>

**Type**

Choose the Target **Type** to display and configure the relevant fields for that scan target.

{% tabs %}
{% tab title="Repository" %}
**Target and variant detection**

**Name**

**Variant**

**Workspace**

#### Authentication <a href="#authentication" id="authentication"></a>

{% tabs %}
{% tab title="API Key" %}
**Access Token**
{% endtab %}

{% tab title="Username and Password" %}
**Domain**

**Access ID**

For **Access ID**, you can use an existing OAuth client in Checkmarx or create a new one and use its `Client ID`.

**Access Token**

For **Access ID**, you can use an existing OAuth client in Checkmarx or create a new one and use its `Client Secret`.
{% endtab %}
{% endtabs %}

***

#### Ingestion File <a href="#ingestion-file" id="ingestion-file"></a>

This filed is visible when you are using **Ingestion** Scan Mode

#### Scan Tool <a href="#scan-tool" id="scan-tool"></a>

**Project Name**

If the specified project does not exist, the step will create a new project using the provided Project Name.

**Use Raw Scanner Severity**
{% endtab %}

{% tab title="Container Image" %}
**Target and variant detection**

**Name**

**Variant**

#### Container Image <a href="#container-image" id="container-image"></a>

**Type**

**Domain**

**Name**

**Tag/Digest**

**Access Id**

**Access Token**

#### Authentication <a href="#authentication" id="authentication"></a>

{% tabs %}
{% tab title="API Key" %}
**Access Token**
{% endtab %}

{% tab title="Username and Password" %}
**Domain**

**Access ID**

For **Access ID**, you can use an existing OAuth client in Checkmarx or create a new one and use its `Client ID`.

**Access Token**

For **Access ID**, you can use an existing OAuth client in Checkmarx or create a new one and use its `Client Secret`.
{% endtab %}
{% endtabs %}

***

#### Ingestion File <a href="#ingestion-file" id="ingestion-file"></a>

This filed is visible when you are using **Ingestion** Scan Mode

#### Scan Tool <a href="#scan-tool" id="scan-tool"></a>

**Project Name**

If the specified project does not exist, the step will create a new project using the provided Project Name.

**Use Raw Scanner Severity**
{% endtab %}

{% tab title="Instance" %}
**Target and variant detection**

**Name**

**Variant**

#### Authentication <a href="#authentication" id="authentication"></a>

**Domain**

**Access Token**

***

#### Ingestion File <a href="#ingestion-file" id="ingestion-file"></a>

This filed is visible when you are using **Ingestion** Scan Mode

#### Scan Tool <a href="#scan-tool" id="scan-tool"></a>

**Team Name**

Enter your Checkmarx One [Tenant Name](https://docs.checkmarx.com/en/34965-68530-logging-in-to-checkmarx-one.html).\
Provide the tenant name in the format `/<server-name>/<team-name>`.\
Example: `/server1.myorg.org/devOpsEast`

**Project Name**

Enter the project name to be scanned.

* If the specified project does not exist, the step creates a new project with the provided name.
* The provided [Domain URL](#domain-3) is configured as the project name if a new project is created.

**Environment ID**

Enter your [Checkmarx One Environment ID](https://docs.checkmarx.com/en/34965-154695-dast-creating-environments.html). You can execute the step by entering only the existing Checkmarx One Environment ID without specifying any optional fields.

**Scan Type**

Select the scan type based on your use case:

* **WEB**: Select if scanning a web application.
* **API**: Select if scanning an API.

**Context Name**

Specify the Checkmarx context file to use for the scan.

* You must add the following shared path (**Overview** > **Shared Paths**) to your stage and copy your context file to this location:\
  `/shared/customer_artifacts/context/`

**Use Raw Scanner Severity**
{% endtab %}
{% endtabs %}

***

#### Log Level <a href="#log-level" id="log-level"></a>

**Fail on Severity**

#### Optional Settings <a href="#optional-settings" id="optional-settings"></a>

For repository scans, you can optionally add the following key value pairs to the **Settings** section of your Checkmarx One step. Harness STO uses these values to call the Checkmarx One API and retrieve repository scan metadata that is not exposed by the Checkmarx One CLI.

* **`product_domain`:** The regional IAM base URL for your Checkmarx One environment.
* **`product_team_name`:** Your Checkmarx One tenant name, also referred to as your account or organization name.

#### Exclude issues marked as Not Exploited <a href="#exclude-issues-marked-as-not-exploited" id="exclude-issues-marked-as-not-exploited"></a>

You can configure the CheckmarxOne ingestion step to exclude issues detected by CheckmarxOne but flagged as Not Exploitable. To enable this setting, add the following key-value pair under **Settings**:

`hide_not_exploitable` : `True`

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

### Proxy settings <a href="#proxy-settings" id="proxy-settings"></a>

### View Checkmarx One issue state <a href="#view-checkmarx-one-issue-state" id="view-checkmarx-one-issue-state"></a>

Harness STO displays the Checkmarx One issue state, including custom states, in the **Issue Details** side panel for repository, container image, and instance scans.