Checkmarx SAST

Checkmarx SAST (CxSAST) is a static application security testing solution used to identify security vulnerabilities in custom code. It is used by development, DevOps, and security teams to scan source code early in the SDLC, identify vulnerabilities, and provide actionable insights to remediate them.

Types of Assets Fetched

This adapter fetches the following types of assets:

• Devices
• Users
• Business Applications

Parameters

1. Host Name or IP Address (required) - The hostname or IP address of the Checkmarx SAST server.

2. User Name and Password (required) - The credentials for a user account that has the Required Permissions to fetch assets.

3. Use OData API - Select this option to use the Checkmarx OData API instead of the REST API. This allows connecting with a read-only service account that has only the "Use OData" role (which grants the "Run OData Queries" permission), without requiring SAST Admin rights. When enabled, the adapter connects to Checkmarx using OData endpoints for authentication and data retrieval and only projects are fetched. See Required Permissions for details.

4. Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

5. HTTPS Proxy (optional) - Connect the adapter to a proxy instead of directly connecting it to the domain.

6. HTTPS Proxy User Name (optional) - The user name to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.

7. HTTPS Proxy Password (optional) - The password to use when connecting to the server using the HTTPS Proxy.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

1. Fetch projects as assets - Select this option to ingest Checkmarx projects as Device Entities.
2. Fetch engine servers as assets - Select this option to ingest "Engine Servers" as Devices.
3. Last scan to include in project - Specify the number of past scans to include in each project. (Default is 1: only the most recent).
4. Include only active users - Select this option to only fetch active users.
5. Parse applications as devices - Select this option to parse applications as devices.

APIs

Axonius uses the following APIs:

• Devices (REST API): Checkmarx SAST API
• Users: Checkmarx SAST Access Control (REST) API
• Devices (OData API): CxSAST OData API

Required Permissions

The required permissions depend on which API mode is used:

• REST API (default) - The value supplied in User Name must have the SAST Admin role.

• OData API - When Use OData API is enabled, the account only needs the "Use OData" Checkmarx role, which grants the "Run OData Queries" permission. Admin rights are not required. This allows connecting with a read-only service account.