Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(reports): support github code scanning output format #7272

Open
apr-1985 opened this issue Oct 8, 2024 · 0 comments
Open

feat(reports): support github code scanning output format #7272

apr-1985 opened this issue Oct 8, 2024 · 0 comments
Labels
community Community contribution feature request Community: new feature request

Comments

@apr-1985
Copy link

apr-1985 commented Oct 8, 2024

Is your feature request related to a problem? Please describe.
Currently the Kics Sarif output format uses the Error, Warning etc format for output in sarif.
This does not play 100% nicely with GitHub which works best with a Critical, High etc format.

It means that Kics results are not seen at the same level as my other app sec tooling and I do not see them in security dashboard overview charts etc.

I can see in the sarif code that you convert from Critical to Error etc https://github.com/Checkmarx/kics/blob/master/pkg/report/model/sarif.go#L17-L23

Describe the solution you'd like
I would like there to be an output format for GitHub that gives the results in a format that plays best with Advanced Security.

Someone from GitHub has given a solution on the Kics Action repo here Checkmarx/kics-github-action#99

Describe alternatives you've considered
In all honesty not using Kics and using another tool that integrates better.

Additional context

Kics results have their own ratings separate to the main GitHub supported ones
Screenshot 2024-10-08 at 11 05 51

Means that Kics doesn't feature in any reports or trend analysis etc where as other 3rd party tools do

Screenshot 2024-10-07 at 14 59 09

@apr-1985 apr-1985 added community Community contribution feature request Community: new feature request labels Oct 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
community Community contribution feature request Community: new feature request
Projects
None yet
Development

No branches or pull requests

1 participant