Connect a static analysis vendor, pick a project, and land taint-flow evidence into one deduplicated finding queue.
This guide shows how to bring SonarQube or Checkmarx SAST results into PMAP. You identify your connector archetype, connect the vendor with credentials encrypted at rest, verify it with an inline connection test, and use the project picker to choose the right scan and route its findings to the correct company and project. You also see how SAST differs from a network scan.
It is written for application security teams unifying static analysis with the rest of their findings. By the end you can import results through the correlation engine so each real issue is created, updated, or reopened exactly once, confirm that file and line, rule key, taint flow, and code snippet land intact on every finding, schedule recurring imports with cron, wire a CI/CD gate on pull requests, and review the per-severity delta after each wave.
Inside this guide
- Understand how SAST differs from a network scan and identify your connector archetype.
- Connect SonarQube or Checkmarx with credentials encrypted at rest and test it inline.
- Pick the project or scan and route findings with a severity threshold to the right tenant.
- Run the import through correlation so each issue is created, updated, or reopened once.
- Confirm taint-flow and code-snippet evidence on every finding.
- Backfill historical scans on onboarding and schedule recurring imports.
- Gate pull requests with a CI/CD check and review the per-severity delta.
Before you start
- A PMAP account with integration create and edit rights, plus finding read access in the target company scope.
- A reachable SonarQube server or Checkmarx instance and a service account token with read access to the relevant projects.
- The minimum severity policy you want at ingest, since the integration applies an import_severity_threshold before correlation.
- The PMAP company and project that imported findings should land in, so multi-tenant routing is unambiguous.
- An SCA integration if you also want a transitive dependency graph alongside SAST taint flow.
