-
Notifications
You must be signed in to change notification settings - Fork 31
Description
Enhancement Request
With the release of OpenText Core Application Security 26.1 we now have support for importing SARIF files:
SARIF import support
Streamline your security posture with SARIF Import. By bringing third-party SAST results directly into the Release Scans page, you are moving toward a comprehensive Application Security Posture Management (ASPM) view of your vulnerabilities. This unified approach allows you to manage all findings from native tools to external scanners within a single, centralized Issues page or via our API. For more information, see "Importing an On-Premises Scan" in the Core Application Security User Guide.
This is available via the API endpoint PUT /api/v3/releases/{releaseId}/static-scans/import-sarif
To expose this capability we should add an additional command for either:
fcli fod release import-sarif
or
fcli fod sast-scan import-sarf
The second option is probably preferred as SARIF format is mainly used for SAST scan results and it follows our existing convention for uploading OSS SBOM results (fcli fod oss-scan import).