Skip to main content

SAST Findings Analysis

Findings Analysis is an optional capability in Checkmarx One that uses AI to automatically review SAST scan results and filter out likely false positives. When enabled, it reduces noise in your results so your team can focus on the findings that matter most, reducing manual triage.

Configuring Findings Analysis

Findings Analysis can be configured globally, under your tenant's LLM-based settings or per project or per scan as an override to the global setting.

Note

Configuration precedence: Tenant → Project → Scan (each level overrides the one before it).

  • Tenant-level: Go to Homepage_settings_cog-account_settings_.png > Global Settings > SAST >, and then under LLM-based Settings, set Findings Analysis to true to enable it (by default Findings Analysis is disabled and set to false).

    sastfa1.png

  • Project-level: Go to Projects > select Vertical_Ellipsis.png > Project Settings > Rules, and then set Findings Analysis to true.

    pjsettingssastfa.png

    Alternatively, you can enable Findings Analysis as a rule when you first create the project. See Creating Projects for more information on rules when creating projects.

  • Scan-level: Include an override in the scan configuration payload, and then set scan.config.sast.findingsAnalysis to true to enable it for that scan.

    {
    "key": "scan.config.sast.findingsAnalysis", 
    "value": "true", 
    "allowOverride": true
}

Findings Analysis also follows your tenant's overall AI usage control. If AI features are disabled at the tenant level, Findings Analysis is disabled as well, regardless of its individual setting. Select Homepage_settings_cog-account_settings_.png > Global Settings > AI, and then under AI Capabilities , ensure Allow AI Usage is toggled on.

sastfa2.png

How Findings Analysis Works

When Findings Analysis is enabled, it automatically classifies eligible SAST findings as good (true positive) or bad (false positive) on the backend. Only High, Medium, Low, and Info severity findings are eligible for classification; Critical severity findings are never analyzed and are always returned in full, regardless of this setting.

Findings Analysis runs once SAST scan results are available, as part of the scan flow. Once classification is complete, only good results are displayed in the result set - bad results are filtered out.

sastfa3.png

Only new findings (State = New) are evaluated this way: on a project's first scan, all findings are analyzed, while on subsequent incremental scans only newly detected findings go through the classification, and previously seen findings are not re-analyzed. Findings Analysis runs after the scan and is logged in the scan's logs (left-sidebar Scans > SAST > Vertical_Ellipsis.png > scroll down "findings analysis" log) and in its Scan Configuration (Scan History > Scan Configuration).

In this section: