Checkmarx integration

Synchronize Seal's remediation findings into Checkmarx via the Checkmarx API.

The Seal CLI calls the Checkmarx API after every seal fix run and updates the corresponding findings in the targeted Checkmarx project. Vulnerabilities Seal has sealed are marked as remediated; vulnerabilities still open stay open.

Before you start

• A Checkmarx API token with permissions to update SCA findings on the target project.

• The Checkmarx project ID for the project Seal is sealing.

• Your Checkmarx tenant URL. For the hosted offering this is https://ast.checkmarx.net.

Configuration

Set these in your CI environment:

SEAL_CHECKMARX_URL=<your checkmarx tenant url>
SEAL_CHECKMARX_TOKEN=<checkmarx api token>
SEAL_CHECKMARX_PROJECT_ID=<checkmarx project id>

Or in .seal-config.yml at the project root:

checkmarx:
  url: <your checkmarx tenant url>
  token: <checkmarx api token>
  project-id: <checkmarx project id>

Verify

After a seal fix run with the integration configured, open the targeted Checkmarx project. Vulnerabilities Seal sealed should reflect a remediated state with a Seal-attributed reason.

Related

• How CLI-driven sync works