Skip to main content

Checkmarx

CatalogScorecards

Overview​

Checkmarx is an automated application security platform that checks source code for security vulnerabilities and compliance issues. Integrate Cortex with Checkmarx to drive insight into the vulnerabilities detected on your entities.

This integration is supported for Checkmarx Static Application Security Testing (SAST).

How to configure Checkmarx with Cortex​

Prerequisites​

Before getting started, create a user with access to the sast_rest_api scope.

Configure the integration in Cortex​

  1. In Cortex, navigate to the Checkmarx settings page:
    1. In Cortex, click your avatar in the lower left corner, then click Settings.
    2. Under "Integrations", click Checkmarx.
  2. Configure the Checkmarx integration form:
    • Username and Password: Enter the username and password for the user with access to sast_rest_api.
    • Host: Enter the full URL of your Checkmarx instance.
  3. Click Save.
caution

If you do not see the settings page you're looking for, you may not have permission to access that page. Please contact your admin for assistance.

caution

If you're using a self-hosted instance of Checkmarx, you'll need to verify that your Cortex instance is able to reach the Checkmarx instance.

We route our requests through a static IP address. Reach out to support at help@cortex.io to receive details about our static IP. If you're unable to directly allowlist our static IP, you can route requests through a secondary proxy in your network that has this IP allowlisted and have that proxy route traffic to your Checkmarx instance.

How to connect Cortex entities to Checkmarx​

Discovery​

By default, Cortex will use your associated Git repository (e.g. repo-name) or the service tag as the "best guess" for the Checkmarx project name.

If your repository and entity names don’t cleanly match the Checkmarx CxSAST project names, or if you have multiple Checkmarx projects for a service, you can add a Checkmarx project ID (recommended) or a Checkmarx project name in the Cortex entity descriptor.

Editing the entity descriptor​

If you need to override automatic discovery, you can define the following block in your Cortex entity descriptor.

We recommend using the project ID as it is a unique identifier across projects.

Example using project IDs:

x-cortex-checkmarx:
  projects:
    - projectId: 1234
    - projectId: 2345

Example using both project IDs and names:

x-cortex-checkmarx:
  projects:
    - projectName: My Cool Project
    - projectId: 1234

Expected results​

Entity pages​

Once the integration is established, vulnerabilities pulled from Checkmarx will be available for each entity in the Code and Security block in the Overview tab and in the Issues and Vulnerabilities block in the Code and Security tab.

While viewing an entity, click Integrations > Checkmarx. On this page, view the number of vulnerabilities per severity and a link directly to your Checkmarx instance: View vulnerability counts in Cortex

Scorecards and CQL​

With the Checkmarx integration, you can create Scorecard rules and write CQL queries based on Checkmarx details.

See more examples in the CQL Explorer in Cortex.

Check if Checkmarx project is set

Check if entity has a registered Checkmarx project in its entity descriptor. If there is a Checkmarx project name, we will try and make sure that the project exists in Checkmarx.

Definition: checkmarx (==/!=) null: Boolean

Example

In a Scorecard, you can write a rule to check whether an entity has a Checkmarx project set:

checkmarx != null
Checkmarx scan risk

Get the maximum scan risk among the entity's project's latest scans

Definition: checkmarx.sastScanRisk(): Number

Example

In a Scorecard, you can write a rule to verify that an entity has no Checkmarx projects where the latest scan risk is higher than 35:

checkmarx.sastScanRisk() < 35
Number of Checkmarx vulnerabilities

Get the count of all vulnerabilities for an entity's Checkmarx project's last scan

Definition: checkmarx.numOfVulnerabilities(): Number

Example

In a Scorecard, you can write a rule to verify that an entity has no vulnerabilities with a severity of HIGH:

checkmarx.numOfVulnerabilities(severity=["High"]) < 1

Verify that an entity has less than 5 vulnerabilities total:

checkmarx.numOfVulnerabilities() < 5

FAQs and troubleshooting​

Does Cortex support integrating with Checkmarx One?​

No, Cortex does not currently support Checkmarx one. Only Checkmarx SAST is supported for this integration.

Still need help?​

The following are all the ways to get assistance from our customer engineering team. Please use the option that is best for your users:

  • Email: help@cortex.io, or open a support ticket in the in app Resource Center
  • Chat: Available in the Resource Center
  • Slack: Users with a connected Slack channel will have a workflow added to their account. From here, you can either @CortexTechnicalSupport or add a :ticket: reaction to a question in Slack, and the team will respond directly.

Don’t have a Slack channel? Talk with your customer success manager.