Checkmarx

• Checkmarx Scan, Checkmarx Scan detailed: XML report from Checkmarx SAST (source code analysis)
• Checkmarx OSA: json report from Checkmarx Open Source Analysis (dependencies analysis)

To generate the OSA report using Checkmarx CLI: ./runCxConsole.sh OsaScan -v -CxServer <...> -CxToken <..> -projectName <...> -enableOsa -OsaLocationPath <lib_folder> -OsaJson <output_folder>

That will generate three files, two of which are needed for defectdojo. Build the file for defectdojo with the jq utility: jq -s . CxOSAVulnerabilities.json CxOSALibraries.json

Data for SAST, SCA and KICS are supported.

Sample Scan Data#

Sample Checkmarx scans can be found here.

Default Deduplication Hashcode Fields#

By default, DefectDojo identifies duplicate Findings using these hashcode fields:

• cwe
• severity
• file path