Skip to main content
Cortex connects to many third-party vendors whose system interfaces frequently change. As a result, integration behavior or configuration steps may shift without notice. If you encounter unexpected issues, check with your system administrator or refer to the vendor’s documentation for the most current information. Additionally, integration sync times vary and are subject to scheduling overrides and timing variance.
Semgrep is static application security testing (SAST) tool that includes software composition analysis (SCA). It detects security vulnerabilities in your code and analyzes your open-source dependencies for vulnerabilities. You can use it to scan local repositories or integrate it into your CI/CD pipeline. Integrating Semgrep with Cortex allows you to:
  • Display the latest scans and vulnerability data on entity details pages in Cortex
  • Create Scorecards that track progress and drive alignment on projects involving Semgrep security data, allowing you to address and remediate vulnerabilities more efficiently

​
How to configure Semgrep with Cortex

​
Prerequisites

Before getting started:

​
Configure the integration in Cortex

  1. In Cortex, navigate to the Semgrep settings page:
    • Click Integrations from the main nav. Search for and select Semgrep.
  2. Click Add configuration.
  3. Configure the Semgrep integration form:
    • Alias: Enter an alias for this integration.
    • API key: Enter the value of the API token you created in Semgrep.
    • Organization ID: Enter your organization ID for Semgrep.
    • Organization slug: Enter your organization slug for Semgrep.
  4. Click Save.
After saving your configuration, you are redirected to the Semgrep integration settings page in Cortex. In the upper right corner of the page, click Test configuration to ensure Semgrep was configured properly.

​
How to connect Cortex entities to Semgrep

​
Match entity names to Semgrep projects

By default, Cortex will use the Cortex tag (e.g. my-service) as the “best guess” for Semgrep projects. For example, if your entity name is “My Service” or your tag is my-service, then the corresponding project name in Semgrep should also be “My Service” or my-service. If your Semgrep project names don’t cleanly match the Cortex entity name or tag, you can override this in the Cortex entity descriptor.

​
Editing the entity descriptor

Under the x-cortex-semgrep block in an entity’s YAML, you can define the projects you want based on the Semgrep project ID. For example:

​
Using the Semgrep integration

​
Viewing Semgrep information in Cortex

Semgrap vulnerabilities and scans appear on entity details pages:
  • in the Code & security block in the entity’s overview: See Semgrep data on an entity's overview.
  • in the entity’s sidebar in Code & security.
    • This page contains scan results and vulnerability metrics from Semgrep. Click Filter at the top of the vulnerability list to filter by severity.
    On an entity, click Code & security > Semgrep to view vulnerability details from Semgrep.

​
Scorecards and CQL

With the Semgrep integration, you can create Scorecard rules and write CQL queries based on Semgrep projects. See more examples in the CQL Explorer in Cortex.
Check if entity has a registered Semgrep project in its entity descriptor.Definition: semgrep (==/!=) null: BooleanExampleAn initial level in a security Scorecard might include a rule to make sure entities are associated with a Semgrep project:
Setting a semgrep != null rule can also serve as a secondary check to confirm an entity is synced properly with Semgrep and is reporting frequently.
List of Semgrep vulnerabilities by severity or type.Definition: semgrep.vulnerabilities()ExampleYou can write a rule to verify an entity has fewer than 10 vulnerabilities:
Get Semgrep scan results for an entity.Definition: semgrep.scans()You could write a Scorecard rule to ensure an entity has fewer than 10 scans:
You could write a rule to ensure an entity has had fewer than 10 new scans in the last week:

​
View integration logs

This feature is available in Cortex cloud.
While viewing an integration’s settings page, select the Error logs tab to view errors from the last 7 days. You can filter the logs list by configuration and by operation (for example, you could filter to view errors surfaced only via Scorecards).
The 'Logs' tab on an integration's settings page shows error information over the past 7 days.
Click into a row to get more information, including time stamp, status code, full error, and request path.

​
Still need help?↗

The following options are available to get assistance from the Cortex Customer Engineering team:
  • Email: help@cortex.io, or open a support ticket in the in app Resource Center
  • Slack: Users with a connected Slack channel will have a workflow added to their account. From here, you can either @CortexTechnicalSupport or add a :ticket: reaction to a question in Slack, and the team will respond directly.
Don’t have a Slack channel? Talk with your Customer Success Manager.
Last modified on September 9, 2026