Configuring Projects Using Config as Code Files

PresetName

All the available SAST Presets that exist in the system

--sast-preset-name boolean

scan.config.sast.presetName

  {
    "key": "scan.config.sast.presetName",
    "value": "ASA Premium",
    "allowOverride": true
  }

presetName

Fast scan mode

true / false

By default, the Fast Scan mode is set to true.

For more information, refer to Fast Scan Mode.

--sast-fast-scan boolean

scan.config.sast.fastScanMode

  {
    "key": "scan.config.sast.fastScanMode",
    "value": "true",
    "allowOverride": true
  }

fastScanMode

Light queries

true/false

Determines whether the scan should be performed using light queries or standard queries. Light Queries are simplified versions of standard queries focusing on the most urgent vulnerabilities, helping you spot threats faster.

For more information, refer to Light Queries.

--sast-light-queries

scan.config.sast.lightQueries

  {
    "key": "scan.config.sast.lightQueries",
    "value": "true",
    "allowOverride": true
  }

lightQueries

incremental

true / false

Determines whether the scan should be performed incrementally or as a full scan.

--sast-incremental boolean

scan.config.sast.incremental

  {
    "key": "scan.config.sast.incremental",
    "value": "true",
    "allowOverride": true
  }

incremental

Recommended exclusions

true / false

Determines whether the system should automatically exclude certain files and folders from the scan. Enabled by default.

By default, recommended exclusions is set to true.

--sast-recommended-exclusions

scan.config.sast.recommendedExclusions

  {
    "key": "scan.config.sast.recomendedExclusions",
    "value": "true",
    "allowOverride": true
  }

recommendedExclusions

LanguageMode

primary / multi

For more information, see:

Specifying a Code Language for Scanning

Supported Code Languages and Frameworks:

scan.config.sast.languageMode

  {
    "key": "scan.config.sast.languageMode",
    "value": "primary",
    "allowOverride": true
  }

languageMode

Folder/file filter

Allow users to select specific folders or files to include or exclude from the code scanning process.

--sast-filter <string>

scan.config.sast.filter

  {
    "key": "scan.config.sast.filter",
    "value": "*.java",
    "allowOverride": true
  }

filter

EngineVerbose

true / false

scan.config.sast.engineVerbose

  {
    "key": "scan.config.sast.engineVerbose",
    "value": "true",
    "allowOverride": true
  }

engineVerbose

Results scope level

Project / Application

When you triage SAST results (change state, severity, comments), by default the adjustment applies only to identical results within that Project. You can adjust this setting to apply changes to all identical results in the entire Application.

Threshold for Incremental Scans (%)

0.5 - 10 (intervals of .5)

When running an incremental scan, if the changes from the previous scan exceed the threshold, a full scan is run. By default the threshold is 7%. Use this configuration to set a custom threshold. For more information, see Adjusting the Incremental Scan Threshold.

scan.config.sast.incrementalChangeThreshold

  {
    "key": "scan.config.sast.incrementalChangeThreshold",
    "value": "1",
    "allowOverride": true
  }

incrementalChangeThreshold

Incremental in branch (API)

true / false

When working with branches within Checkmarx GitHub Integration, if you open a pull request to merge into the master branch, you could run a faster incremental scan instead of a longer full scan. This capability is activated by configuring this setting to true. By default, it is false, so that only scans of the main branch are run as incremental. For more information, see Result Sco.

scan.config.sast.incrementalInBranch

  {
    "key": "scan.config.sast.incrementalInBranch",
    "value": "true",
    "allowOverride": true
  }

incrementalInBranch

Folder/file filter

Allow users to select specific folders or files to include or exclude from the code-scanning process.

--iac-security-filter <string>

scan.config.kics.filter

  {
    "key": "scan.config.kics.filter",
    "value": "*.java",
    "allowOverride": true
  }

filter

Platforms

--iac-security-platforms <string>, <string>

scan.config.kics.platforms

  {
    "key": "scan.config.kics.platforms",
    "value": "GRPC",
    "allowOverride": true
  }

platforms

Preset Name

All the available IaC Security Presets that exist in the system

There are no Checkmarx Default Presets now. For more information on IaC presets, see here.

presetId

Folder/file filter

Allow users to select specific folders or files that they want to include or exclude from the code scanning process.

--sca-filter <string>

scan.config.sca.filter

  {
    "key": "scan.config.sca.filter",
    "value": "*.java,*.js",
    "allowOverride": true
  }

filter

Exploitable Path

Toggle On/Off

When Exploitable Path is activated, scans that use the SCA scanner will identify whether or not there is an exploitable path from your source code to the vulnerable 3rd party package.

Learn more about Exploitable Path.

--sca-exploitable-path <string>

scan.config.sca.ExploitablePath

  {
    "key": "scan.config.sca.ExploitablePath",
    "value": "true",
    "allowOverride": true
  }

ExploitablePath

Exploitable Path Configuration

Radio button selection

The Exploitable Path feature uses queries in the SAST scan of your project to identify exploitable paths to vulnerable 3rd party packages. Therefore, it is always necessary to run a SAST scan on the project in order to get results for Exploitable Path.

Whenever you run a Checkmarx One scan with both the SAST and SCA scanners selected, Exploitable Path uses the results of the current SAST scan for analysis. When you run a Checkmarx One scan with only the SCA scanner selected, Checkmarx One can either use results from a previous SAST scan or it can initiate a new SAST scan (using default settings) that runs the Exploitable Path queries. Select one of the following configurations:

--sca-last-sast-scan-time <integer>

scan.config.sca.LastSastScanTime

  {
    "key": "scan.config.sca.LastSastScanTime",
    "value": "25",
    "allowOverride": true
  }

LastSastScanTime

New Vulnerability Comparison Mode

Project-Wide (default) or Branch-Based

Determines what is used as the base-line for determining whether or not a vulnerability is a New finding in the current scan.

scan.config.sca.vulnerabilityComparisonMode

  {
    "key": "scan.config.sca.vulnerabilityComparisonMode",
    "value": "Branch-Based",
    "allowOverride": true
  }

vulnerabilityComparisonMode

Java Language Version

8, 11, 17, 21 (default) or 25

Specify the Java version used for dependency resolution for gradle package manager. This version does not affect Java version used for maven resolution. If not defined, gradle scans will run with Java version 21 by default.

scan.config.sca.javaLanguageVersion

  {
    "key": "scan.config.sca.javaLanguageVersion",
    "value": "17",
    "allowOverride": true
  }

javaLanguageVersion

Python Language Version

2.7, 3.11, 3.12, 3.13 (default) or 3.14

Specify the Python version used for dependency resolution for pip and poetry package managers. Poetry does not support Python prior to version 3, if version 2.7 is supplied, the default version is used instead. If not defined, scans will run with Python version 3.13 by default.

scan.config.sca.pythonLanguageVersion

  {
    "key": "scan.config.sca.pythonLanguageVersion",
    "value": "3.12",
    "allowOverride": true
  }

pythonLanguageVersion