Skip to main content

Check out Port for yourself 

Checkmarx One

This integration allows you to model Checkmarx One resources in your software catalog and ingest data into them.
It lets you map and organize the desired Checkmarx One resources and their metadata in Port (see supported resources below).

Supported Resources​

The resources that can be ingested from Checkmarx One into Port are listed below. It is possible to reference any field that appears in the API responses linked below in the mapping configuration.

  • Project - Project information and metadata
  • Scan - Security scan execution details and status
  • SAST - Static Application Security Testing results
  • SCA - Software Composition Analysis results
  • KICS - Infrastructure as Code Security results
  • Container Security - Container security scan results
  • API Security - API security risks and vulnerabilities

Setup​

Prerequisites​

  1. A Checkmarx One enterprise account.
  2. A Port organization with admin permissions.
Checkmarx One API Access

The Checkmarx One API is available for enterprise customers. You need an API key to authenticate with the Checkmarx One API.

Port Credentials​

To get your Port credentials, go to your Port application, click on the ... button in the top right corner, and select Credentials. Here you can view and copy your CLIENT_ID and CLIENT_SECRET:

Checkmarx One Credentials​

You need the following connection details to configure Checkmarx One:

  • Checkmarx One Base URL: The API endpoint URL for your region
  • Checkmarx One IAM URL: The IAM authentication URL for your region
  • Tenant Name: Your Checkmarx One tenant name
  • API Key: Your Checkmarx One API key
Regional URLs

Checkmarx One provides different URLs based on your region:

  • US: https://ast.checkmarx.net/api / https://iam.checkmarx.net
  • EU: https://eu.ast.checkmarx.net/api / https://eu.iam.checkmarx.net
  • US2: https://us.ast.checkmarx.net/api / https://us.iam.checkmarx.net
  • EU2: https://eu-2.ast.checkmarx.net/api / https://eu-2.iam.checkmarx.net
  • DEU: https://deu.ast.checkmarx.net/api / https://deu.iam.checkmarx.net
  • ANZ: https://anz.ast.checkmarx.net/api / https://anz.iam.checkmarx.net
  • IND: https://ind.ast.checkmarx.net/api / https://ind.iam.checkmarx.net
  • SNG: https://sng.ast.checkmarx.net/api / https://sng.iam.checkmarx.net
  • UAE: https://mea.ast.checkmarx.net/api / https://mea.iam.checkmarx.net

  1. Finding Your Checkmarx One Base URL and IAM URL:

    • Login to your Checkmarx One account
    • Navigate to Settings > Identity and Access Management
    • The base URL and IAM URL will be displayed based on your region
    • Copy and save both URLs for use in the integration configuration

  2. Getting Your Tenant Name:

    • Your tenant name is typically part of your login URL
    • It can also be found in your account settings
    • Copy and save your tenant name

  3. Generating an API Key:

    • Login to Checkmarx One with admin permissions
    • Navigate to Settings > Identity and Access Management > API Keys
    • Click Add API Key
    • Provide a descriptive name for the API key
    • Select the appropriate permissions (read access to projects, scans, and results)
    • Click Create API Key
    • Copy and securely store the generated API key
API Key Security

Store your API key securely and never share it. The API key provides access to your Checkmarx One data.

Choose one of the following installation methods:
Not sure which method is right for your use case? Check the available installation methods.

Using this installation option means that the integration will be hosted by Port, with a customizable resync interval to ingest data into Port.

Live event support

This integration supports live events, allowing real-time updates to your software catalog without waiting for the next scheduled sync.

Supported live event triggers
  • scan_completed_successfully
  • scan_failed
  • scan_partial
Self-hosted installation

Alternatively, you can install the integration using the Self-hosted method to update Port in real time using webhooks.

Installation

To install, follow these steps:

  1. Go to the Data sources page of your portal.

  2. Click on the + Data source button in the top-right corner.

  3. Click on the relevant integration in the list.

  4. Under Select your installation method, choose Hosted by Port.

  5. Configure the integration settings and application settings as you wish (see below for details).

Application settings

Every integration hosted by Port has the following customizable application settings, which are configurable after installation:

  • Resync interval: The frequency at which Port will ingest data from the integration. There are various options available, ranging from every 1 hour to once a day. If a sync is still in progress when the next one is due, the new sync will be skipped (up to 24 hours delay).
    This ensures that all kinds are fully synchronized and that cleanup of stale entities always takes place at the end of each sync.

  • Send raw data examples: A boolean toggle (enabled by default). If enabled, raw data examples will be sent from the integration to Port. These examples are used when testing your mapping configuration, they allow you to run your jq expressions against real data and see the results.

Integration settings

Every integration has its own tool-specific settings, under the Integration settings section.
Each of these settings has an ⓘ icon next to it, which you can hover over to see a description of the setting.

Port secrets

Some integration settings require sensitive pieces of data, such as tokens.
For these settings, Port secrets will be used, ensuring that your sensitive data is encrypted and secure.

When filling in such a setting, its value will be obscured (shown as ••••••••).
For each such setting, Port will automatically create a secret in your organization.

To see all secrets in your organization, follow these steps.

Limitations

  • The maximum time for a full sync to run is based on the configured resync interval. For very large amounts of data where a resync operation is expected to take longer, please use a longer interval.

Port source IP addresses

When using this installation method, Port will make outbound calls to your 3rd-party applications from static IP addresses.
You may need to add these addresses to your allowlist, in order to allow Port to interact with the integrated service:

54.73.167.226  
63.33.143.237  
54.76.185.219

Configuration​

Port integrations use a YAML mapping block to ingest data from the third-party api into Port.

The mapping makes use of the JQ JSON processor to select, modify, concatenate, transform and perform other operations on existing fields and values from the integration API.

Default mapping configuration​

This is the default mapping configuration for this integration:

Default mapping configuration (click to expand)
createMissingRelatedEntities: true
deleteDependentEntities: true
resources:
  - kind: project
    selector:
      query: 'true'
    port:
      entity:
        mappings:
          blueprint: '"checkmarxProject"'
          identifier: .id
          title: .name
          properties:
            name: .name
            createdAt: .createdAt
            updatedAt: .updatedAt
            tags: (.tags // {})
            repoUrl: .repoUrl
            mainBranch: .mainBranch
            origin: .origin
            criticality: .criticality

  - kind: scan
    selector:
      query: 'true'
    port:
      entity:
        mappings:
          blueprint: '"checkmarxScan"'
          identifier: .id
          title: '(.projectId + "-" + .id)'
          properties:
            status: .status
            branch: .branch
            createdAt: .createdAt
            updatedAt: .updatedAt
            projectId: .projectId
            userAgent: .userAgent
            configs: (.configs // {})
            statusDetails: (.statusDetails // [])
          relations:
            project: .projectId

  - kind: sast
    selector:
      query: 'true'
    port:
      entity:
        mappings:
          identifier: .resultHash
          title: .queryName
          blueprint: '"checkmarxSast"'
          properties:
            firstScanId: .firstScanID
            status: .status
            state: .state
            severity: (.severity // empty)
            confidenceLevel: .confidenceLevel
            created: .firstFoundAt
            nodes: (.nodes // empty)
            cweId: (.cweID // empty)
          relations:
            scan: .scanID

  - kind: sca
    selector:
      query: 'true'
    port:
      entity:
        mappings:
          identifier: .id
          title: .data.packageIdentifier
          blueprint: '"checkmarxSCA"'
          properties:
            firstScanId: .firstScanId
            status: .status
            state: .state
            severity: .severity
            created: .created
            description: .description
            packageIdentifier: .data.packageIdentifier
            recommendations: .data.recommendations
            recommendedVersion: .data.recommendedVersion
            packageData: .data.packageData
            cweId: .vulnerabilityDetails.cweId
          relations:
            scan: .__scan_id

  - kind: kics
    selector:
      query: 'true'
    port:
      entity:
        mappings:
          identifier: .id
          title: .description
          blueprint: '"checkmarxKics"'
          properties:
            type: .type
            firstScanId: .firstScanId
            id: .id
            status: .status
            state: .state
            severity: (.severity // empty)
            confidenceLevel: .confidenceLevel
            created: .created
            description: .description
            fileName: (.data.fileName // empty)
            line: (.data.line // empty)
            platform: (.data.platform // empty)
            issueType: (.data.issueType // empty)
            expectedValue: (.data.expectedValue // empty)
            value: (.data.value // empty)
        relations:
          scan: .__scan_id

  - kind: containers
    selector:
      query: 'true'
    port:
      entity:
        mappings:
          identifier: .id
          title: .id
          blueprint: '"checkmarxContainerSecurity"'
          properties:
            firstScanId: .firstScanId
            status: .status
            state: .state
            severity: .severity
            confidenceLevel: .confidenceLevel
            created: .created
            description: .description
            packageName: .data.packageName
            packageVersion: .data.packageVersion
            imageName: .data.imageName
            imageTag: .data.imageTag
            imageFilePath: .data.imageFilePath
            cweId: .vulnerabilityDetails.cweId
          relations:
            scan: .__scan_id

  - kind: apisec
    selector:
      query: 'true'
    port:
      entity:
        mappings:
          identifier: .risk_id
          title: .name
          blueprint: '"checkmarxApiSec"'
          properties:
            riskId: .risk_id
            apiId: .api_id
            severity: (.severity // empty)
            name: .name
            status: .status
            httpMethod: .http_method
            url: .url
            origin: .origin
            documented: .documented
            authenticated: .authenticated
            discoveryDate: .discovery_date
            scanId: .scan_id
            sastRiskId: (.sast_risk_id // empty)
            projectId: .project_id
            state: .state
        relations:
          scan: .scan_id
Deep links to Checkmarx One dashboard

If you need to ingest deep links back to the Checkmarx One dashboard, you can construct them using jq expressions in your mapping configuration. Combine your Checkmarx One UI base URL with relevant path parameters from the data returned by the API.

For example, to create a dashboard link for a project:

dashboardUrl: '"https://your-region.ast.checkmarx.net/projects/" + .id'

Or for a specific scan result:

scanUrl: '"https://your-region.ast.checkmarx.net/projects/" + .projectId + "/scans/" + "?id=" + .id'

Replace your-region with your actual Checkmarx One region (e.g., eu, us, deu, etc.) and adjust the path structure based on your Checkmarx One dashboard URL format.

Monitoring and sync status​

To learn more about how to monitor and check the sync status of your integration, see the relevant documentation.

Examples​

To view and test the integration's mapping against examples of the third-party API responses, use the jq playground in your data sources page. Find the integration in the list of data sources and click on it to open the playground.

Examples of blueprints and the relevant integration configurations can be found on the Checkmarx examples page.

Resource Configuration​

The Checkmarx One integration supports filtering and configuration for different resource types:

Project Resources​

Projects can be synchronized without additional filtering options.

Scan Resources​

Scans can be filtered using the following scan filter options:

  • Project Names (projectIds): Filter scans by their project name
  • Branches: Filter results by the name of the Git branch that was scanned
  • Statuses: Filter results by the execution status of the scans (case insensitive, OR operator for multiple statuses):
    • Queued
    • Running
    • Completed
    • Failed
    • Partial
    • Canceled
  • Since: Filter results by the date and time when the scan was created (UNIX timestamp in seconds, default: 90 days)

Security Scan Results (SCA/Containers) Configuration​

You can configure security scan results (SCA, Container Security) with the following filters:

  • Scan Filter: Apply the same scan filtering options as above
  • Severity: Filter by severity level (CRITICAL, HIGH, MEDIUM, LOW, INFO)
  • State: Filter by state:
    • TO_VERIFY
    • CONFIRMED
    • URGENT
    • NOT_EXPLOITABLE
    • PROPOSED_NOT_EXPLOITABLE
    • FALSE_POSITIVE
  • Status: Filter by status (NEW, RECURRENT, FIXED)
  • Exclude Result Types: Filter to exclude dev and test dependencies (DEV_AND_TEST, NONE)

SAST (Static Application Security Testing) Configuration​

SAST results can be configured with comprehensive filtering options:

  • Scan Filter: Apply the same scan filtering options as above
  • Compliance: Filter by compliance standard (exact match, case insensitive)
  • Group: Filter by vulnerability group (substring match)
  • Include Nodes: Include or omit node data (default: true)
  • Language: Filter by language (exact match, case insensitive)
  • Result ID: Filter by unique result hash
  • Severity: Filter by severity level (critical, high, medium, low, info)
  • Status: Filter by status (new, recurrent, fixed)
  • Category: Filter by comma separated list of categories
  • State: Filter by state:
    • to_verify
    • not_exploitable
    • proposed_not_exploitable
    • confirmed
    • urgent

KICS (Infrastructure as Code Security) Configuration​

KICS results can be configured with the following filters:

  • Scan Filter: Apply the same scan filtering options as above
  • Severity: Filter KICS results by severity levels (CRITICAL, HIGH, MEDIUM, LOW, INFO)
  • Status: Filter KICS results by status (NEW, RECURRENT, FIXED)

API Security Configuration​

API security results can be configured with:

  • Scan Filter: Apply the same scan filtering options as above

Troubleshooting​

Common Issues​

  1. Authentication Errors: Ensure your API key is valid and has the correct permissions
  2. Regional URL Issues: Verify you're using the correct base URL and IAM URL for your region
  3. Tenant Name Issues: Make sure your tenant name is correctly specified
  4. Permission Issues: Ensure your API key has read access to projects, scans, and results

Logs and Debugging​

The integration provides detailed logging for debugging:

  • Check the integration logs for authentication and API request details
  • Verify that the correct URLs and credentials are being used
  • Monitor for any rate limiting or permission errors

For more detailed troubleshooting, refer to the Checkmarx One API documentation.

Alternative installation via webhook​

While the Ocean integration described above is the recommended installation method, you may prefer to use a webhook to ingest data from Checkmarx One. If so, use the following instructions:

Note that when using the webhook installation method, data will be ingested into Port only when the webhook is triggered.

Webhook installation (click to expand)

In this example you are going to create a webhook integration between Checkmarx One and Port, which will ingest Checkmarx One scan events and results.

Port configuration

Create the following blueprint definitions:

Checkmarx Scan blueprint (click to expand)
{
  "identifier": "checkmarxScan",
  "title": "Checkmarx Scan",
  "icon": "Checkmarx",
  "schema": {
    "properties": {
      "status": {
        "type": "string",
        "title": "Status",
        "enum": [
          "Queued",
          "Running",
          "Completed",
          "Failed",
          "Partial",
          "Canceled"
        ],
        "description": "The status of the scan. Possible values: Queued, Running, Completed, Failed, Partial, Canceled."
      },
      "branch": {
        "type": "string",
        "title": "Branch",
        "description": "The branch of the repository that was scanned."
      },
      "createdAt": {
        "type": "string",
        "format": "date-time",
        "title": "Created At",
        "description": "The date and time when the scan was created."
      },
      "updatedAt": {
        "type": "string",
        "format": "date-time",
        "title": "Updated At",
        "description": "The date and time when the scan was last updated."
      },
      "projectId": {
        "type": "string",
        "title": "Project ID",
        "description": "The identifier of the project to which this scan belongs."
      },
      "userAgent": {
        "type": "string",
        "title": "User Agent",
        "description": "The user agent used to initiate the scan."
      }
    },
    "required": ["status", "projectId"]
  },
  "relations": {}
}

Create the following webhook configuration using Port's UI

Checkmarx One webhook configuration (click to expand)
  1. Basic details tab - fill the following details:
    1. Title : Checkmarx One mapper;
    2. Identifier : checkmarx_one_mapper;
    3. Description : A webhook configuration to map Checkmarx One scan events to Port;
    4. Icon : Checkmarx;
  2. Integration configuration tab - fill the following JQ mapping:
{
  "mappings": [
    {
      "blueprint": "checkmarxScan",
      "itemsToParse": ".body",
      "entity": {
        "identifier": ".item.scanId",
        "title": "(.item.projectId + \"-\" + .item.scanId)",
        "properties": {
          "status": ".item.status",
          "branch": ".item.branch",
          "createdAt": ".item.createdAt",
          "updatedAt": ".item.updatedAt",
          "projectId": ".item.projectId",
          "userAgent": ".item.userAgent"
        }
      }
    }
  ],
  "enabled": true,
  "security": {}
}
  1. Click Save at the bottom of the page.

Create a webhook in Checkmarx One

You can follow the instruction in Checkmarx One's webhook documentation, they are also outlined here for reference:

  1. Log in to Checkmarx One with admin permissions.
  2. Navigate to Settings > Webhooks.
  3. Click Add Webhook.
  4. Input the following details:
    1. Name - use a meaningful name such as Port Webhook.
    2. Payload URL - enter the value of the url key you received after creating the webhook configuration.
    3. Under Events - select the following events:
      • Project Created
      • Completed Scan
      • Failed Scan
      • Partial Scan
  5. Click Create Webhook at the bottom of the page.
Checkmarx One events and payload

In order to view the different payloads and events available in Checkmarx One webhooks, look here

Done! any project creation and scan completion event (successful, failed, or partial) will trigger a webhook event that Checkmarx One will send to the webhook URL provided by Port. Port will parse the events according to the mapping and update the catalog entities accordingly.

Webhook Configuration Options

Checkmarx One supports two types of webhook configurations with different scoping levels:

Tenant-Level Webhooks​

  • Scope: Receive events from all projects within your Checkmarx One tenant
  • Use Case: When you want to monitor all security scans across your entire organization
  • Configuration: Set up the webhook at the tenant level in Checkmarx One settings
  • Events: All scan events (scan_completed_successfully, scan_failed, scan_partial) from any project

Project-Scoped Webhooks​

  • Scope: Receive events only from specific projects you select
  • Use Case: When you want to monitor only certain critical projects or applications
  • Configuration: Set up the webhook at the project level in Checkmarx One settings
  • Events: Scan events only from the selected project(s)
Choosing the Right Scope
  • Use tenant-level webhooks for comprehensive security monitoring across your organization
  • Use project-scoped webhooks when you need granular control or want to reduce noise from non-critical projects

Let's Test It

This section includes a sample webhook event sent from Checkmarx One when a scan is completed. In addition, it includes the entity created from the event based on the webhook configuration provided in the previous section.

Payload

Here is an example of the payload structure sent to the webhook URL when a Checkmarx One scan is completed:

Webhook event payload (click to expand)
{
  "id": "f62213cb-183b-4a48-b880-56640d45d209",
  "status": "Running",
  "branch": "main",
  "createdAt": "2025-09-08T17:39:31.344557Z",
  "updatedAt": "2025-09-08T17:39:31.448929Z",
  "projectId": "6ace8769-7ad3-4812-8990-0d4111ba0156",
  "projectName": "Test-Project/test-repo",
  "userAgent": "grpc-java-netty/1.63.0",
  "initiator": "user@company.org",
  "tags": {},
  "metadata": {
    "id": "f62213cb-183b-4a48-b880-56640d45d209",
    "type": "git",
    "Handler": {
      "GitHandler": {
        "branch": "main",
        "repo_url": "https://github.com/Test-Org/test-repo",
        "credentials": {
          "type": "apiKey",
          "value": "*****",
          "username": "*****"
        }
      }
    },
    "configs": [
      {
        "type": "sast",
        "value": {
          "presetName": "",
          "incremental": "false"
        }
      },
      {
        "type": "sca"
      },
      {
        "type": "kics"
      },
      {
        "type": "apisec"
      }
    ],
    "project": {
      "id": "6ace8769-7ad3-4812-8990-0d4111ba0156"
    },
    "created_at": {
      "nanos": 128635019,
      "seconds": 1757353171
    }
  },
  "engines": [
    "sast",
    "sca",
    "kics",
    "apisec"
  ],
  "sourceType": "github",
  "sourceOrigin": "Project Scan"
}

Mapping Result

The combination of the sample payload and the webhook configuration generates the following Port entity:

{
  "identifier": "f62213cb-183b-4a48-b880-56640d45d209",
  "title": "6ace8769-7ad3-4812-8990-0d4111ba0156-f62213cb-183b-4a48-b880-56640d45d209",
  "blueprint": "checkmarxScan",
  "properties": {
    "status": "Running",
    "branch": "main",
    "createdAt": "2025-09-08T17:39:31.344557Z",
    "updatedAt": "2025-09-08T17:39:31.448929Z",
    "projectId": "6ace8769-7ad3-4812-8990-0d4111ba0156",
    "userAgent": "grpc-java-netty/1.63.0",
    "configs": {},
    "statusDetails": []
  },
  "relations": {
    "project": "6ace8769-7ad3-4812-8990-0d4111ba0156"
  }
}