Checkmarx One

Overview

The Checkmarx One integration connects the Praetorian Guard Platform (PGP) with your Checkmarx One environment, importing static analysis findings as risks and mapping your scanned repositories as assets. Checkmarx One consolidates multiple scanning engines — SAST, SCA, Secrets detection, KICS (Infrastructure as Code), and Container scanning — and this integration brings those findings directly into PGP so your application security posture is tracked alongside the rest of your attack surface.

This is especially valuable for organizations running Checkmarx One as their application security testing platform. Rather than monitoring findings in two places, the integration automatically surfaces scan results in PGP, closing the gap between code-level vulnerabilities and your broader security posture.

What the Integration Does

The integration is read-only: PGP queries the Checkmarx One API and imports scan results as risks and their associated repositories as assets. It does not modify any projects, scans, or configurations in Checkmarx.

How it works:

1. Authentication — PGP exchanges your Checkmarx API key (a JWT refresh token) for an access token via the OpenID Connect token endpoint, then uses Bearer token authentication for all API calls.

2. Project enumeration — PGP queries the /api/projects endpoint to discover all projects in your Checkmarx tenant.

3. Scan retrieval — For each project, PGP fetches completed scans from the last 7 days (falling back to the most recent scan if none are found in that window).

4. Result import — PGP retrieves vulnerability results from each scan and maps them to PGP risks with appropriate severity, CVSS scores, and remediation details.

5. Asset creation — Each Checkmarx project's Git repository is imported as a repository asset in PGP, serving as the container for all associated findings.

Supported Scan Types

Detected Risks

Risks are created from Checkmarx findings with type-specific naming conventions:

Severity Mapping

Risk severity is determined from the Checkmarx finding data:

• CVSS Score (preferred for SCA, if > 0) — Numeric score mapped to CVSS-equivalent severity

• Severity Level (all other types) — Direct mapping: Critical → Critical, High → High, Medium → Medium, Low → Low

Filtering

The following results are automatically excluded from import:

• Results marked as Not Exploitable or Proposed Not Exploitable

• Results with status Fixed

• Informational severity findings

• SCA results with only local attack vectors (non-network exploitable)

• Scorecard results (sscs-scorecard type)

Prerequisites

• A Checkmarx One account with API access

• An API key (JWT refresh token) generated from Checkmarx One

• Your Checkmarx One instance URL (e.g., https://ast.checkmarx.net)

Creating an API Key

1. Log in to Checkmarx One

2. Navigate to Settings > Identity and Access Management

3. Generate a new API key

4. Copy the key — it is displayed only once

For detailed instructions, see Checkmarx documentation on generating API keys.

Finding Your Instance URL

Your instance URL is the base URL you use to access Checkmarx One. Common examples:

Setup

1. In PGP, navigate to Integrations and locate Checkmarx under the Secure Code Scanning category.

2. Click Integrate.

3. Enter the following fields and click Connect.

PGP validates your credentials by exchanging the refresh token for an access token and making a lightweight test call to GET /api/projects?offset=0&limit=1.

What Data Is Synced

Scan Results to PGP Risks

• Vulnerability findings from SAST, SCA, Secrets, KICS, and Container scans are imported as risks

• Each risk includes the finding type, severity, description, and remediation guidance

• A proof file with full finding metadata is attached for evidence and traceability

• SCA findings include CVE identifiers and CVSS scores for accurate severity mapping

• Findings marked as Not Exploitable, Fixed, or Informational are automatically excluded

Projects to PGP Assets

• Each Checkmarx project's Git repository URL is imported as a repository asset

• Repository assets serve as containers for all findings from that project

• Assets are linked to the scan's Git branch and repository metadata

Checkmarx API Endpoints Used

Troubleshooting

Security and Data Handling

• OAuth 2.0 refresh token exchange over HTTPS — the refresh token is never sent to Checkmarx APIs directly, only to the IAM token endpoint

• API key encrypted at rest and in transit within your PGP deployment

• Entirely read-only — PGP never modifies projects, scans, results, or any configuration in Checkmarx

• Only scan metadata and vulnerability details are imported — no source code is accessed or stored

• Access tokens are short-lived and obtained per integration run

Integration category: Secure Code Scanning. Data direction: Read-only (Checkmarx to PGP). Authentication: OAuth 2.0 refresh token exchange.