Checkmarx
Checkmarx is an application security testing (AST) platform used to find vulnerabilities in code before it reaches production. It's one of the more widely used tools in the "shift-left" security space.
Usage of Checkmarx in Delivery Shield
Delivery Shield integrates with Checkmarx to perform scans on your source code, identifying vulnerabilities such as SQL injection, XSS, insecure deserialization, and hardcoded secrets as part of the pipeline.
Checkmarx findings are correlated with results from other scanners (SCA, IaC, SBOM) and factored into the overall security score, giving a unified view of application risk across the SSDLC.
To Manage Checkmarx:
Navigate to Setup > Integrations.
In the Artifact panel, click Checkmarx.
The Checkmarx integration page is displayed.
Click +New Account.
In the popup that appears, enter the following details:
Account Name (mandatory): Enter a unique identifier name to distinguish this Checkmarx integration account from others.
URL(mandatory): Enter the base URL or endpoint of your target Checkmarx instance.
Tenant Account Name (mandatory): Specify the name of the tenant account associated with your Checkmarx environment.
Client Id (mandatory): Enter the Client ID credential used to securely authenticate with the Checkmarx API.
Client Secret (mandatory): Enter the corresponding Client Secret used alongside the Client ID to authenticate with the Checkmarx API.
Select the Teams and the corresponding Environments from the dropdown for which you want the integration to be available. The integration will be available for the selected teams and environment only. You can select up to 5 teams for the integration to be displayed.
An example is given below for reference:
In the example above,
If Team 1, Team 2, and Team 3 are selected, only applications associated with these teams can access the integration. Any applications belonging to other teams, such as Team 4, will not have access to this account.
Even if the user who created this account is also an admin for Team 4, the integration account remains restricted and is not available for Team 4.
Access to the account is strictly limited to the specified Teams and Environments selected during account creation.
For Organization Admins:
When an Organization Admin creates an account without selecting specific Teams and Environments, the account will be universally applicable, granting access to all teams and all environments by default.
For Team Admins with Multiple Teams:
If a Team Admin who manages multiple teams creates an account without specifying particular Teams and Environments, the account will only be accessible to the teams for which the logged-in user holds admin privileges.
6. Click Save. The tool is connected.
7. You can edit the entered values by clicking the Edit option as shown below:
8. Enter the new values and click Update.
The new setting gets updated.
Last updated