Import Reports from Security Tools

The system supports importing scan results from external security tools. The system processes scan results in the following ways:

• parses universal output formats, such as SARIF;
• parses report formats supported by security tools.

The following table lists the formats supported by security tools.

Security tool	File format	Format name
Aqua	HTML inside JSON	Custom HTML Report
CodeScoring	JSON	Custom CodeScoring JSON
ESLint	JSON	ESLint Report JSON
External	JSON	SARIF 2.1.0
GitLab Advanced SAST	JSON	GitLab SAST Report JSON
Gitleaks	JSON	Gitleaks JSON Report
Grype	JSON	Grype Vulnerability Report JSON
KCS	JSON	KCS (Kubescape) JSON
KICS	JSON	KICS Scan Results JSON
Manual	JSON	ASOC Manual Issue Format JSON
OWASP Dependency Track	JSON	CycloneDX-based JSON
PT AI	JSON	PT Application Inspector JSON
PVS	JSON	SARIF 2.1.0
SASTAV	JSON	SASTAV Security Scan Report JSON
Semgrep	JSON	Semgrep Results JSON
Solar Appscreener	JSON	Custom JSON (SCA/DAST/SAST)
Stingray	JSON	Stingray Defect Report JSON
Trivy	JSON	Trivy Vulnerability Report JSON
TruffleHog	JSON / NDJSON	TruffleHog Findings JSON

Recommendations for choosing a report format

For the most accurate import, we recommend specifying the security tool and generating the report in the format listed for that tool in the table above. We’ve verified the reliability of these tool and format combinations, so TRON.ASOC recognizes these reports with the highest accuracy.

You can also import a report in the universal SARIF 2.1.0 format without specifying a security tool or by specifying a tool that isn't listed above. However, the completeness and accuracy of data recognition depend on how closely the security tool's report conforms to the SARIF specification. Not all security tools generate SARIF reports that fully and strictly conform to the specification.

There are no technical limits on the size of an imported report or the number of vulnerabilities it contains. However, importing a very large amount of data can slow down the import process. If the file content doesn't match the format, the import ends with a parsing error, and the system doesn't upload the report.

When you upload a scan report again from the same tool:

• Issues that weren't present in previously uploaded reports aren't created. The system considers the issues present in the uploaded report.
• The system updates the last detected time for issues that appear again in the new report.

When you enable Partial import, the system doesn't overwrite issues imported from earlier reports when it imports subsequent reports. For example, if the first report contains 5 issues and the second contains 2 new issues, the total number of detected issues with Partial import enabled is 7 rather than 2, which would be the total with the option disabled.

Upload a report to the system

To upload a scan report generated outside the system, follow these steps:

1. Go to Projects → Project name → Security layers.
2. Select the more actions button () next to the required scan.

tip

You can upload SBOM reports for some tools. For more information about uploading SBOM reports, see SBOM reports.

3. Select Import results.
4. In the form that opens, upload the SARIF file with the results.
5. Select Partial import if you don't want to close missing issues.
6. Select Save.

The following example shows a report in SARIF format.

{
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "MySecurityScanner",
          "rules": [
            {
              "id": "SEC001",
              "name": "InsecureLibraryUse",
              "helpUri": "https://example.com/rules/SEC001-CVE-2023-12345",
              "properties": {
                "tags": ["security", "CWE-79", "injection"],
                "references": [
                  "https://cwe.mitre.org/data/definitions/79.html",
                  "https://nvd.nist.gov/vuln/detail/CVE-2023-12345"
                ]
              }
            }
          ]
        }
      },
      "properties": {
        "category": "dependency-analysis"
      },
      "results": [
        {
          "ruleId": "SEC001",
          "level": "error",
          "message": {
            "text": "Vulnerable library detected: lodash@4.17.11"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "src/utils/parser.js"
                },
                "region": {
                  "startLine": 42,
                  "snippet": {
                    "text": "const _ = require('lodash');"
                  }
                }
              }
            }
          ],
          "codeFlows": [
            {
              "threadFlows": [
                {
                  "locations": [
                    {
                      "location": {
                        "physicalLocation": {
                          "artifactLocation": {
                            "uri": "src/utils/parser.js"
                          },
                          "region": {
                            "startLine": 42
                          }
                        }
                      }
                    }
                  ]
                }
              ]
            }
          ],
          "properties": {
            "input_issue_id": "ISSUE-00123",
            "security-severity": 8.5,
            "info_links": [
              "https://cwe.mitre.org/data/definitions/79.html",
              "https://nvd.nist.gov/vuln/detail/CVE-2023-12345"
            ],
            "library_name": "lodash",
            "library_version": "4.17.11"
          }
        }
      ]
    }
  ]
}