Skip to main content

Managing Projects

A Checkmarx One project defines the source to be scanned and uses scanners, scan tags, and group assignments. Normally, a Checkmarx One project should correspond to or be part of a software development project. Anytime a scan is run, the results remain associated with the project.

For Continuous Integration development methodology, if a new branch is created for each iteration, update the code location within the existing project (rather than creating a new project) so that all the results reside within a single project.

For every Project that exists in Checkmarx One, the following actions are available:

Viewing the Projects Tab

The Workspace Workspace.png > Projects screen enables you to manage and monitor your Checkmarx One Projects.

The expandable Filters & Groups section lets you group the projects list by Risk Level and display the applied table filters.

Below that, the Projects pane shows a list of the projects in your account. Hover over the Results button on the desired Project row and select the desired scanner to see detailed scan results, or you can click on the Overview icon to open the project page.

The following table describes the information shown for each project and the actions that can be taken.

Item

Description

Possible Values

Selection Box

Select multiple checkboxes to bulk delete the selected Projects. The Delete Projects button appears at the top of the table.

Project Name

The name of the Project.

 

Risk Level

The risk level of the Project is based on the vulnerabilities that were identified.

Critical, High, Medium, Low, No Risk

Total Vulnerabilities

The number of vulnerabilities identified for each severity level is shown.

Note

Checkmarx uses the newest available CVSS scoring system. If a vulnerability has a CVSS v3.1 score, that score is used; if it only has a CVSS 2.0 score in NVD, that score is used.

Most vulnerabilities have CVSS 3.1 scores, and all unique Cx Vulnerabilities are ranked using the CVSS 3.1 system.

Last Scan

Shows how much time has passed since the Project was last scanned.

Applications

Displays applications associated with a given project.

Note

The applications in the column are only visible if you have the view application permission enabled in Access Management. A project can be assigned to multiple applications, but you will only see the ones accessible to you. If you do not have this permission, the column will show N/A instead.

Internet Facing

Shows if the project is internet-facing.

Tags

Shows tags in key or key:value pairs applied to this Project.

Groups

Shows the groups that are assigned to the project.

Scan Origin

Shows how the most recent scan of the Project was triggered.

webapp, Push Webhook, etc.

Source

Shows how the source code was accessed for the most recent scan.

Zip, GitHub, etc.

Quick Actions Buttons - hover over the desired Project to reveal the quick action buttons.

Results

Hovering over the Results link will display the severity of each scanner for the last successfully completed scan. Clicking on a specific scanner will open the last scan results in the Results Viewer.

SCA, IaC Security, SAST

Copy ID

Hover over the desired Project and click on the Copy ID Dulpicate.png icon in a Project’s row to copy the ID of that Project to your clipboard.

Overview

Opens the Project page, which shows detailed information about the Project.

Scan

Initiates a new scan for the Project.

Action Menu

Associate to Applications

Assign the Project to one or more Applications. See Managing Applications

Project Settings

Edit the Project settings. See Configuring Projects

Query Editor

Opens the default SAST or IaC Query Editor. If both options are available, a dropdown appears to select one. See here for more details on IaC Query Editor and here for SAST Query Editor.

Optimization Service Order

Order Optimization service from the Checkmarx AppSec experts for this Project.

Generate Project Report

Generate a Project report. See Project Reports

Delete Project

Delete the Project and its associated scans. See Deleting Projects