Review the essential system requirements, required SARIF v2.1.0 schema fields, and repository mapping parameters to successfully ingest third-party SAST data.
System requirements
Before utilizing a Collector, verify the following system requirements.
Requirement | Description |
|---|---|
Input Format | Valid SARIF v2.1.0 JSON strictly adhering to the standard. The collector will not ingest files with invalid formats or schema violations. |
File Size | Maximum 10 MB per upload. Larger files must be split. |
Network | Outbound HTTPS (port 443) access to the public API. TLS 1.2+ required. |
File paths | SARIF |
SARIF format and mapping
The 3rd Party AppSec Collector accepts findings in SARIF (Static Analysis Results Interchange Format) version 2.1.0, an OASIS standard for expressing the output of static analysis tools. The SARIF file must be a valid JSON document conforming to the SARIF 2.1.0 schema.
Required SARIF fields:
Field | Path | Description |
|---|---|---|
Tool name |
| The name of the security tool that produced the findings. Recommended: Set the collector name to match the |
Rules |
| The array of detection rule definitions used by the tool. Each rule must include an Rules can also be defined in |
Results |
| The array of individual findings detected by the tool. Each result must include a |
Rule ID |
| The unique identifier of the detection rule that produced the finding. Must match an |
Message |
| A human-readable description of the finding |
File URI |
| The relative file path URI where the finding was detected (such as |
Region |
| The line and column information within the file. Must include at least |
Optional SARIF fields that improve finding quality
Field | Path | Description |
|---|---|---|
Severity level |
| The severity of the finding ( |
Rule description |
| A short description of the detection rule. Also supported at |
Rule help |
| Remediation guidance for the detection rule. Also supported at |
Code snippet |
| The source code snippet where the finding was detected |
End line |
| The ending line number of the finding region. Enables precise multi-line highlighting |
CWE |
| CWE identifiers (such as |
Rule properties |
| Additional metadata for the rule, including |
Severity mapping
The platform normalizes SARIF severity levels to Cortex Cloud severity values following a two-step resolution order:
The platform checks the
runs[].results[].levelfield on the individual finding result.f the result-level field is absent, the platform falls back to the
runs[].tool.driver.rules[].defaultConfiguration.levelfield on the matching rule definition.If neither field is present, the platform assigns a default severity of High.
SARIF level | Cortex Cloud severity |
|---|---|
|
|
|
|
|
|
|
|
Repository mapping
Unlike vendor integrations that map vendor projects to Cortex Cloud repositories during setup, the 3rd Party AppSec Collector maps findings to repositories at upload time. Each upload request must include at least one repository identifier, either repository_id or repository_url as a query parameter that associates the uploaded findings with a specific Cortex Cloud repository asset.
Parameter | Required | Use When | Description |
|---|---|---|---|
| One of | The Cortex Cloud repository asset ID is known. Preferred for CI/CD automation because the ID is stable and unambiguous | The Cortex Cloud repository asset ID to associate the findings with. Obtain the repository asset ID from the |
| One of | The Cortex Cloud repository asset ID is not readily available. Suitable for initial setup or when integrating tools that only expose the repository URL | The full URL of the repository (such as |
| Optional | The findings are branch-specific and the branch name is available in the CI/CD environment | The branch name where the findings were detected (such as |
Validation statuses
The SARIF file validation endpoint returns one of three statuses:
Status | Description |
|---|---|
| The SARIF file conforms to the expected schema and all required fields are present. The file is ready for production upload |
| The SARIF file is structurally valid but contains warnings (such as missing optional fields that improve finding quality). The file can be uploaded but findings may have reduced detail |
| The SARIF file does not conform to the expected schema. The file cannot be uploaded until the validation errors are resolved |