Skip to content

Commit 96c0319

Browse files
skywalke34skywalke34
authored
Update checkmarx_one.md - remove line number references
Removed references to line numbers within the parser.py.
1 parent 65bb216 commit 96c0319

1 file changed

Lines changed: 38 additions & 38 deletions

File tree

‎docs/content/en/connecting_your_tools/parsers/file/checkmarx_one.md‎

Lines changed: 38 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -33,76 +33,76 @@ The parser can handle several variations of the Checkmarx One JSON output format
3333

3434
### Standard Format Field Mapping Details
3535

36-
| Data Field # | Checkmarx Data Field | DefectDojo Finding Field | Parser Line # | Notes |
37-
|--------------|----------------------|--------------------------|---------------|-------|
38-
| 1 | type | unsaved_tags | 361-368 | Added as a tag identifying the finding type (sast, kics, sca, etc.) |
39-
| 2 | id | unique_id_from_tool | 342, 392, 409 | Primary unique identifier for the finding |
40-
| 3 | similarityId | unique_id_from_tool | 342, 392, 409 | Used as fallback if id not present |
41-
| 4 | status | - | 374 | Used for state determination but not directly mapped |
42-
| 5 | state | active, verified, false_p | 534-546 | Maps Checkmarx states to DefectDojo fields through determine_state function |
43-
| 6 | severity | severity | 343, 393, 410 | Converted to title case (e.g., "HIGH" → "High") |
44-
| 7 | firstFoundAt | date | 351-354 | Used as finding date if USE_FIRST_SEEN setting is True |
45-
| 8 | foundAt | date | 351-354 | Used as finding date if USE_FIRST_SEEN setting is False |
46-
| 9 | description | description, title | 341, 391, 408 | Used for both description and title when available |
47-
| 10 | descriptionHTML | - | - | Not mapped - HTML version of description is ignored |
48-
| 11 | data.queryId | - | - | Used in KICS findings but not directly mapped |
49-
| 12 | data.queryName | title (partial) | 341, 391 | Used as part of the title construction when needed |
50-
| 13 | data.group/category | description (partial) | 120 | Added to description for KICS findings with "Category" prefix |
51-
| 14 | data.line | line | 345 | Line number in file where vulnerability exists |
52-
| 15 | data.fileName/filename | file_path | 344, 394 | Path to the vulnerable file |
53-
| 16 | data.expectedValue | mitigation (partial) | 129-133 | Added to mitigation for KICS findings |
54-
| 17 | data.value | mitigation (partial) | 129-133 | Added to mitigation for KICS findings |
55-
| 18 | data.nodes[].fileName | description (partial) | 320-328 | Used in node snippets for SAST findings |
56-
| 19 | data.nodes[].method | description (partial) | 320-328 | Used in node snippets for SAST findings |
57-
| 20 | data.nodes[].line | description (partial) | 320-328 | Used in node snippets for SAST findings |
58-
| 21 | data.nodes[].code | description (partial) | 320-328 | Used in node snippets for SAST findings |
59-
| 22 | vulnerabilityDetails.cweId | cwe | 350, 353 | CWE ID number |
60-
| 23 | vulnerabilityDetails.cvss | - | - | Not mapped directly |
61-
| 24 | cveId | unsaved_vulnerability_ids | 414-415 | For SCA findings, mapped to vulnerability IDs list |
36+
| Data Field # | Checkmarx Data Field | DefectDojo Finding Field | Notes |
37+
|--------------|----------------------|--------------------------|-------|
38+
| 1 | type | unsaved_tags | Added as a tag identifying the finding type (sast, kics, sca, etc.) |
39+
| 2 | id | unique_id_from_tool | Primary unique identifier for the finding |
40+
| 3 | similarityId | unique_id_from_tool | Used as fallback if id not present |
41+
| 4 | status | - | Used for state determination but not directly mapped |
42+
| 5 | state | active, verified, false_p | Maps Checkmarx states to DefectDojo fields through determine_state function |
43+
| 6 | severity | severity | Converted to title case (e.g., "HIGH" → "High") |
44+
| 7 | firstFoundAt | date | Used as finding date if USE_FIRST_SEEN setting is True |
45+
| 8 | foundAt | date | Used as finding date if USE_FIRST_SEEN setting is False |
46+
| 9 | description | description, title | Used for both description and title when available |
47+
| 10 | descriptionHTML | - | Not mapped - HTML version of description is ignored |
48+
| 11 | data.queryId | - | Used in KICS findings but not directly mapped |
49+
| 12 | data.queryName | title (partial) | Used as part of the title construction when needed |
50+
| 13 | data.group/category | description (partial) | Added to description for KICS findings with "Category" prefix |
51+
| 14 | data.line | line | Line number in file where vulnerability exists |
52+
| 15 | data.fileName/filename | file_path | Path to the vulnerable file |
53+
| 16 | data.expectedValue | mitigation (partial) | Added to mitigation for KICS findings |
54+
| 17 | data.value | mitigation (partial) | Added to mitigation for KICS findings |
55+
| 18 | data.nodes[].fileName | description (partial) | Used in node snippets for SAST findings |
56+
| 19 | data.nodes[].method | description (partial) | Used in node snippets for SAST findings |
57+
| 20 | data.nodes[].line | description (partial) | Used in node snippets for SAST findings |
58+
| 21 | data.nodes[].code | description (partial) | Used in node snippets for SAST findings |
59+
| 22 | vulnerabilityDetails.cweId | cwe | CWE ID number |
60+
| 23 | vulnerabilityDetails.cvss | - | Not mapped directly |
61+
| 24 | cveId | unsaved_vulnerability_ids | For SCA findings, mapped to vulnerability IDs list |
6262

6363
### Field Mapping Details
6464

6565
The parser contains three main methods for parsing different formats of Checkmarx One output:
6666

67-
1. `parse_results` (lines 337-370): Main entry point for parsing the standard format with a top-level `results` array
68-
2. `parse_vulnerabilities` (lines 222-249): For parsing the format with a `vulnerabilities` array
69-
3. `parse_vulnerabilities_from_scan_list` (lines 49-62): For parsing formats with separate sections by vulnerability type
67+
1. `parse_results`: Main entry point for parsing the standard format with a top-level `results` array
68+
2. `parse_vulnerabilities`: For parsing the format with a `vulnerabilities` array
69+
3. `parse_vulnerabilities_from_scan_list`: For parsing formats with separate sections by vulnerability type
7070

7171
Each vulnerability type has specialized parsing logic:
7272

73-
1. **SAST (Static Application Security Testing)** - `get_results_sast` (lines 389-404):
73+
1. **SAST (Static Application Security Testing)** - `get_results_sast`:
7474
- Focuses on code-level vulnerabilities
7575
- Uses file path from the first node
7676
- Tags findings with "sast"
7777

78-
2. **KICS (Kubernetes/IaC Security)** - `get_results_kics` (lines 406-423):
78+
2. **KICS (Kubernetes/IaC Security)** - `get_results_kics`:
7979
- Infrastructure as Code findings
8080
- Extracts filename from data field
8181
- Tags findings with "kics"
8282

83-
3. **SCA (Software Composition Analysis)** - `get_results_sca` (lines 425-440):
83+
3. **SCA (Software Composition Analysis)** - `get_results_sca`:
8484
- Vulnerability in dependencies/packages
8585
- Handles CVE IDs when present
8686
- Tags findings with "sca" or "sca-container"
8787

8888
### Special Processing Notes
8989

9090
#### Status Conversion
91-
- The `determine_state` function (lines 534-546) handles state conversion for all finding types
91+
- The `determine_state` function handles state conversion for all finding types
9292
- Maps Checkmarx One states to DefectDojo fields:
9393
- "TO_VERIFY", "PROPOSED_NOT_EXPLOITABLE", "CONFIRMED", "URGENT" → active=True
9494
- "NOT_EXPLOITABLE", "CONFIRMED", "URGENT" → verified=True
9595
- "NOT_EXPLOITABLE" → false_p=True
9696
- All findings explicitly set duplicate=False and out_of_scope=False
9797

9898
#### Severity Conversion
99-
- Severity values from Checkmarx One ("HIGH", "MEDIUM", "LOW", etc.) are converted to title case (lines 343, 393, 410)
99+
- Severity values from Checkmarx One ("HIGH", "MEDIUM", "LOW", etc.) are converted to title case
100100
- The parser takes the severity directly from the Checkmarx One finding and formats it to match DefectDojo's expected format
101101
- No numerical conversion is performed, as Checkmarx One already provides categorical severity levels
102102

103103
#### Description Construction
104104
- For SAST findings with nodes:
105-
- Function `get_node_snippet` (lines 320-328) formats code snippets
105+
- Function `get_node_snippet` formats code snippets
106106
- Includes file name, method name, line number, and code
107107
- Adds node snippets to description with separator
108108
- For KICS findings:
@@ -111,7 +111,7 @@ Each vulnerability type has specialized parsing logic:
111111
- Can include link to Checkmarx One for viewing the finding
112112

113113
#### Date Processing
114-
- Uses a custom `_parse_date` method (lines 32-38) to handle multiple date formats
114+
- Uses a custom `_parse_date` method to handle multiple date formats
115115
- Supports both string dates (parsed with dateutil.parser) and Timestamp objects with "seconds" field
116116

117117
#### Title Format
@@ -122,7 +122,7 @@ Each vulnerability type has specialized parsing logic:
122122

123123
#### Mitigation Construction
124124
- For KICS findings:
125-
- Combines actual and expected values (lines 129-133)
125+
- Combines actual and expected values
126126
- Format: "**Actual Value**: {value}\n**Expected Value**: {expectedValue}\n"
127127
- For SAST findings:
128128
- Uses general recommendations from CWE information when available
@@ -133,7 +133,7 @@ Each vulnerability type has specialized parsing logic:
133133
- No custom hash calculation is performed
134134

135135
#### Tags Handling
136-
- Every finding gets tagged with its type (lines 368, 403, 419)
136+
- Every finding gets tagged with its type
137137
- Tags include: "sast", "kics", "sca", "sca-container"
138138

139139
#### Common Settings for All Findings

0 commit comments

Comments
 (0)