> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/coverity-scanner-reference.md).

# Coverity step configuration

You can ingest scan results from [Coverity Scan](https://scan.coverity.com/) into Harness STO.

### Important notes for running Coverity scans in STO <a href="#important-notes-for-running-coverity-scans-in-sto" id="important-notes-for-running-coverity-scans-in-sto"></a>

#### Root access requirements <a href="#root-access-requirements" id="root-access-requirements"></a>

#### For more information <a href="#for-more-information" id="for-more-information"></a>

### Coverity step configuration <a href="#coverity-step-configuration" id="coverity-step-configuration"></a>

The following steps outline the recommended workflow:

1. Add a Build or Security stage to your pipeline.
2. Add a Run step to upload your Coverity scan results to the pipeline workspace.
3. Add a Coverity step after the Run step and then configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

#### Target <a href="#target" id="target"></a>

**Type**

**Target and variant detection**

**Name**

**Variant**

#### Ingestion File <a href="#ingestion-file" id="ingestion-file"></a>

#### Log Level <a href="#log-level" id="log-level"></a>

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

In the **Additional Configuration** settings, you can use the following options:

* [Privileged](/continuous-integration/use-harness-ci/use-harness-ci/manage-dependencies/background-step-settings.md#privileged)
* [Image Pull Policy](/continuous-integration/use-harness-ci/use-harness-ci/manage-dependencies/background-step-settings.md#image-pull-policy)
* [Run as User](/continuous-integration/use-harness-ci/use-harness-ci/manage-dependencies/background-step-settings.md#run-as-user)
* [Set Container Resources](/continuous-integration/use-harness-ci/use-harness-ci/manage-dependencies/background-step-settings.md#set-container-resources)

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

In the **Advanced** settings, you can use the following options:

* [Conditional Execution](/harness-ai/use-harness-platform/pipelines/step-skip-condition-settings.md)
* [Failure Strategy](/harness-ai/use-harness-platform/pipelines/failure-handling/define-a-failure-strategy-on-stages-and-steps.md)
* [Looping Strategy](/harness-ai/use-harness-platform/pipelines/looping-strategies/looping-strategies-matrix-repeat-and-parallelism.md)
* [Policy Enforcement](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-overview.md)

### YAML pipeline example <a href="#yaml-pipeline-example" id="yaml-pipeline-example"></a>

The following pipeline example illustrates an ingestion workflow. It consists of two steps:

* A Run step that generates a simple Coverity data file.
* A Coverity step that ingests the XML data.

```yaml
pipeline:
  name: coverity-example
  identifier: coverityexample
  projectIdentifier: STO
  orgIdentifier: default
  tags: {}
  stages:
    - stage:
        name: coverity-ingest
        identifier: coverityingest
        description: ""
        type: SecurityTests
        spec:
          cloneCodebase: false
          platform:
            os: Linux
            arch: Amd64
          runtime:
            type: Cloud
            spec: {}
          execution:
            steps:
              - step:
                  type: Run
                  name: generate_coverity_results_file
                  identifier: Run_1
                  spec:
                    shell: Sh
                    command: |-
                      cat <<EOF >> coverity-results.xml
                      <?xml version='1.0' encoding='UTF-8'?>
                      <cov:exportedProjectDefects xmlns:cov="http://coverity.com">
                          <cov:mergedDefect cid="153368" type="Resource leak" impact="High" status="New" firstDetected="10/24/15" owner="Unassigned" classification="Unclassified" severity="High" action="Undecided" displayComponent="Other" category="Resource leaks" file="/webgoat-container/src/main/java/org/owasp/webgoat/session/UserDatabase.java" function="UserDatabase.getUsers" checker="RESOURCE_LEAK" occurrenceCount="1" cwe="404" externalReference="" issueKind="Various" Language="Java" LineNumber="132" Score=""/>
                          <cov:mergedDefect cid="59180" type="Explicit null dereferenced" impact="Medium" status="New" firstDetected="09/20/14" owner="Unassigned" classification="Unclassified" severity="Medium" action="Undecided" displayComponent="Other" category="Null pointer dereferences" file="/webgoat-container/src/main/java/org/owasp/webgoat/session/WebgoatProperties.java" function="WebgoatProperties.main" checker="FORWARD_NULL" occurrenceCount="1" cwe="476" externalReference="" issueKind="Quality" Language="Java" LineNumber="143" Score=""/>
                      </cov:exportedProjectDefects>
                      EOF
              - step:
                  type: Coverity
                  name: ingest_coverity_data
                  identifier: ingest_coverity_data
                  spec:
                    mode: ingestion
                    config: default
                    target:
                      type: repository
                      name: coverity-test
                      variant: test
                    advanced:
                      log:
                        level: info
                    ingestion:
                      file: coverity-results.xml

```