> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/ingest-sarif-data.md).

# Ingest SARIF scan results

[Static Analysis Results Interchange Format (SARIF)](https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning) is an open data format supported by many scan tools, especially tools available as GitHub Actions. You can easily ingest SARIF 2.1.0 data from any tool that supports this format.

#### Important notes for ingesting SARIF data into STO <a href="#important-notes-for-ingesting-sarif-data-into-sto" id="important-notes-for-ingesting-sarif-data-into-sto"></a>

* This workflow is intended for scanners that have no supported integration in STO. Harness recommends that you always use the documented workflow for supported scanners. For a list of all STO-supported scanners, go to [Scanners supported by STO](/security-testing-orchestration/new-to-sto/sto-whats-supported/scanners.md).
* Harness STO also supports an STO Custom JSON format for unsupported scanners that can't publish to SARIF. For more information, go to [Ingest Results from Unsupported Scanners](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/ingesting-issues-from-other-scanners.md).

#### Workflow for ingesting SARIF data into STO <a href="#workflow-for-ingesting-sarif-data-into-sto" id="workflow-for-ingesting-sarif-data-into-sto"></a>

The following workflow describes how to set up an ingestion pipeline for any scanner that supports SARIF.

1. Add a shared path such as `/shared/scan_results` to the stage. Go to **Overview** > **Shared Paths** in the visual editor, or add it to the YAML like this:

```yaml
    - stage:
      spec:
        sharedPaths:
          - /shared/scan_results
```

2. Publish your scan results to a data file in [SARIF 2.1.0 ](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html)format.

   You might want to set up a Run step to generate your scans automatically whenever the pipeline runs.
3. Copy the SARIF file to the `/shared/scan_results` folder.
4. Add an ingestion step after the Run step and configure it as follows.
   1. If your scanner has its own step in the Step Library, add that step. If your scanner doesn't have its own step, add a [Custom Ingest](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-ingest-reference.md) step.
   2. Set the **Scan Mode** to **Ingestion**.
   3. Enter the full path and filename in **Ingestion File**.

Here's an example of how to configure a Gitleaks step to ingest a SARIF data file:

```yaml
- step:
   type: Gitleaks
   name: gitleaks
   identifier: gitleaks
   spec:
      mode: ingestion
      config: default
      target:
         name: nodegoat
         type: repository
         variant: dev
      advanced:
         log:
         level: debug
      ingestion:
         file: /shared/scan_results/gitleaks.sarif
   description: gitleaks step
```

### Example workflows for ingesting SARIF data into STO <a href="#example-workflows-for-ingesting-sarif-data-into-sto" id="example-workflows-for-ingesting-sarif-data-into-sto"></a>

The following topics describe end-to-end example pipelines for ingesting SARIF data:

* [Custom Ingest settings reference](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-ingest-reference.md)
* [Example workflow: Ingest SARIF data from a Checkmarx GitHub Action scan](/security-testing-orchestration/use-sto/sto-scanner-configuration/checkmarx/checkmarx-scanner-reference.md)
* [Run scans using GitHub Action and Drone Plugin steps](/security-testing-orchestration/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/run-scans-using-github-actions.md)