Installation and Configuration of MID Server for Vulnerability Response Integration with SAST

Configure SAST

Select this checkbox to enable the Checkmarx SAST integration and its configuration fields.

Checkmarx Server URL

The base URL of your on-premise Checkmarx SAST server (e.g., http://<server_ip> ).

User Name

The username for the dedicated SAST integration user.

Password

The password for the SAST integration user.

MID Server

Select the configured MID Server that has network access to your SAST server.

Category Name

If a value is provided, all imported SAST vulnerabilities will be assigned this category name. If left blank, the category name from Checkmarx SAST is used.

Filter Project

Select how to filter SAST projects: By Id or By Name .

Enter Project IDs

(Active when "Filter Project" is "By Id")

Enter a semicolon-separated (;) list of SAST project IDs to include or exclude, e.g.

Include Mode: 1;2;3

Exclude Mode: exclude=4;5 .

Enter Project Names

(Active when "Filter Project" is "By Name")

Enter a semicolon-separated (;) list of project names (or substrings) to include.

Team Names

Enter a semicolon-separated (;) list of full team paths to exclude their projects from the import (e.g., /CxServer/TeamA/SubTeamB ).

Enter Project Custom Fields

Filter projects that have specific custom fields. Enter as key:value pairs separated by semicolons (e.g., App:Retail;Env:Prod ).

Result States

Enter a semicolon-separated (;) list of result states from SAST to import (e.g., To Verify;Confirmed;Not Exploitable ).

SAST Severity

Select the vulnerability severity levels to import from SAST (Critical, High, Medium, Low, Info).

Import Scan Custom Fields

Select this checkbox to import scan-level custom fields from SAST.

Include First Detection Date

When enabled, the "DetectionDate" from SAST will be mapped to the "First Found" field in the Application Vulnerable Item (AVI).

Import Audit Result

When enabled, the integration imports the audit trail results and updates the scans and AVITs

Triaging in ServiceNow

When checked, all imported AVIs are set to an Open state, allowing you to use ServiceNow's triage workflows. If unchecked, AVIs will retain their original state from Checkmarx (e.g., Not Exploitable).

Close AVITs of Deleted Project of SAST

When enabled, if a project is deleted in SAST, its open AVIs in ServiceNow will be automatically closed during the next closure integration run.

Configure SCA

Select this checkbox to enable the Checkmarx SCA integration and its configuration fields.

Checkmarx SCA Access control server URL

The base URL of the SCA Identity and Access Management (IAM) service (e.g., https://platform.checkmarx.com ).

Checkmarx SCA API URL

The base URL of your SCA Environment API (e.g., https://api.sca.checkmarx.net ).

Checkmarx SCA Web App URL

The base URL of the SCA user interface, used for deep links.

SCA Username

The username for the dedicated SCA integration user.

SCA Password

The password for the SCA integration user.

Tenant

The name of your organization's SCA tenant.

Filter Project By IDs

Enter a semicolon-separated (;) list of SCA project UUIDs to include or exclude.

Include Mode: uuid1;uuid2 .

Exclude Mode: exclude=uuid3;uuid4 .

SCA Severity

Select the vulnerability severity levels to import from SCA (Critical, High, Medium, Low).

Close AVITs of Deleted Project of SCA

When enabled, if a project is deleted in SCA, its open AVIs in ServiceNow will be automatically closed during the next closure integration run.

Import Exploitable Path

When enabled, the integration will import exploitable path information for SCA vulnerabilities, if available.

Triaging in ServiceNow

When checked, all imported AVIs are set to an Open state, allowing you to use ServiceNow's triage workflows. If unchecked, AVIs will retain their original state from Checkmarx.