Import reports from security tools
The system supports importing scan results from external security tools. The system processes scan results in the following ways:
- parsing based on universal output formats (SARIF);
- parsing based on report formats supported by security tools.
The following table lists the formats supported by security tools.
| Security tool | File format | Format name |
|---|---|---|
| Aqua | HTML inside JSON | Custom HTML Report |
| CodeScoring | JSON | Custom CodeScoring JSON |
| ESLint | JSON | ESLint Report JSON |
| External | JSON | SARIF 2.1.0 |
| GitLab Advanced SAST | JSON | GitLab SAST Report JSON |
| Gitleaks | JSON | Gitleaks JSON Report |
| Grype | JSON | Grype Vulnerability Report JSON |
| KCS | JSON | KCS (Kubescape) JSON |
| KICS | JSON | KICS Scan Results JSON |
| Manual | JSON | ASOC Manual Issue Format JSON |
| OWASP Dependency Track | JSON | CycloneDX-based JSON |
| PT AI | JSON | PT Application Inspector JSON |
| PVS | JSON | SARIF 2.1.0 |
| SASTAV | JSON | SASTAV Security Scan Report JSON |
| Semgrep | JSON | Semgrep Results JSON |
| Solar Appscreener | JSON | Custom JSON (SCA/DAST/SAST) |
| Stingray | JSON | Stingray Defect Report JSON |
| Trivy | JSON | Trivy Vulnerability Report JSON |
The system doesn't limit the size of an imported report or the number of vulnerabilities it can contain. However, importing a large amount of data can slow down the import process. If the file content doesn't match the format, the import ends with a parsing error, and the system doesn't load the report.
When you upload a scan report again from the same tool:
- The system doesn't create issues that weren't present in previously uploaded reports. It counts the issues present in the uploaded report.
- The system updates the last detected time for issues that appear again in the new report.
When you enable the Partial import option, the system doesn't overwrite issues imported from earlier reports when it imports subsequent reports. For example, if the first report contains 5 issues and the second contains 2 new issues, the total number of detected issues with Partial import enabled is 7. Without this option, the total would be 2.
Upload a report to the system
To upload a scan report generated outside the system, follow these steps:
- Go to Projects → Project name → Security layers.
- Select the additional actions button (
) next to the required scan.
You can upload SBOM reports for some tools. For more information about uploading SBOM reports, see SBOM reports.
- Select Import results.
- In the form that opens, upload the SARIF file with the results.
- Select Partial import if you don't want to close missing issues.
- Select Save.
The following example shows a report in SARIF format.
{
"version": "2.1.0",
"runs": [
{
"tool": {
"driver": {
"name": "MySecurityScanner",
"rules": [
{
"id": "SEC001",
"name": "InsecureLibraryUse",
"helpUri": "https://example.com/rules/SEC001-CVE-2023-12345",
"properties": {
"tags": ["security", "CWE-79", "injection"],
"references": [
"https://cwe.mitre.org/data/definitions/79.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-12345"
]
}
}
]
}
},
"properties": {
"category": "dependency-analysis"
},
"results": [
{
"ruleId": "SEC001",
"level": "error",
"message": {
"text": "Vulnerable library detected: lodash@4.17.11"
},
"locations": [
{
"physicalLocation": {
"artifactLocation": {
"uri": "src/utils/parser.js"
},
"region": {
"startLine": 42,
"snippet": {
"text": "const _ = require('lodash');"
}
}
}
}
],
"codeFlows": [
{
"threadFlows": [
{
"locations": [
{
"location": {
"physicalLocation": {
"artifactLocation": {
"uri": "src/utils/parser.js"
},
"region": {
"startLine": 42
}
}
}
}
]
}
]
}
],
"properties": {
"input_issue_id": "ISSUE-00123",
"security-severity": 8.5,
"info_links": [
"https://cwe.mitre.org/data/definitions/79.html",
"https://nvd.nist.gov/vuln/detail/CVE-2023-12345"
],
"library_name": "lodash",
"library_version": "4.17.11"
}
}
]
}
]
}