Troubleshooting - Address common ingestion issues by validating SARIF schema compliance, checking repository identifiers, and ensuring file paths are relative to the project root. - Administrator Guide - Cortex Cloud Posture Management - Cortex CLOUD

SARIF validation returns INVALID

The SARIF file does not conform to the SARIF 2.1.0 schema.

Verify the SARIF file structure against the SARIF format requirements. Ensure the runs[].tool.driver.name, runs[].results[], and runs[].results[].locations[] fields are present

SARIF validation returns PARTIALLY_VALID

The SARIF file is structurally valid but missing optional fields.

Review the validation warnings. Add missing optional fields (severity level, rule description, CWE tags) to improve finding quality. The file can be uploaded in the current state

Upload returns 401 Unauthorized

The collector credentials (Token ID or API Token) are invalid or expired.

Edit the collector in Settings → Data Sources → 3rd Party AppSec Collector to regenerate the API credentials. Update the credentials in the CI/CD pipeline configuration

Upload returns 400 Bad Request

The request body is not valid JSON or does not conform to the SARIF schema.

Validate the SARIF file using the validation endpoint before uploading. Ensure the Content-Type header is set to application/json

Findings do not appear after upload

The repository_id parameter does not match a valid Cortex Cloud repository asset.

Verify the repository asset ID in Inventories → All Assets → Application Security → Repositories. Ensure the repository is onboarded and active

Findings do not appear after upload

The branch parameter does not match the expected branch name.

Verify the branch name matches the branch naming convention used in the Cortex Cloud repository configuration

Findings appear but lack severity

The SARIF file does not include the level field in the results.

Add the level field (error, warning, note) to each result in the SARIF output. Configure the third-party tool to include severity information in the SARIF output

Findings appear but lack CWE classification

The SARIF file does not include CWE tags in the rule properties.

Add CWE identifiers (e.g., CWE-79) to the runs[].tool.driver.rules[].properties.tags[] array in the SARIF output

CI/CD pipeline fails after collector deletion

The deleted collector credentials are still referenced in the pipeline configuration.

Create a new collector instance, generate new credentials, and update the CI/CD pipeline configuration with the new credentials