AS-Checkmarx-SAST-Ingestion

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


This playbook ingests Checkmarx SAST scan findings into a custom Microsoft Sentinel table on a daily schedule. This single template deploys the custom Log Analytics table, Data Collection Endpoint, Data Collection Rule, Key Vault API connection, Logic App, and all required role assignments.

Attribute Value
Type Playbook
Solution Standalone Content
Source View on GitHub

Logic App Connectors

This playbook uses 2 Logic App connectors / built-in actions:

Connector / Action Type Connections Actions
keyvault Managed 1 1
http Built-in 0 4
Action parameters (URLs, paths, function IDs)

keyvault (Managed)

Action Method Endpoint Other
Get_secret get [concat('/secrets/@{encodeURIComponent(''', parameters('KeyVaultSecretName'), ''')}/value')]

http (Built-in)

Action Method Endpoint Other
HTTP_-_Get_Token POST [concat(parameters('CheckmarxIAMBaseUrl'), '/auth/realms/', parameters('CheckmarxTenant'), '/protocol/openid-connect/token')]
HTTP_-_Get_Scans_Page GET [concat(parameters('CheckmarxASTBaseUrl'), '/api/scans?statuses=Completed&from-date=@{variables(''FromDate'')}&limit=@{variables(''ScanPageSize'')}&offset=@{variables(''ScanOffset'')}')]
HTTP_-_Get_SAST_Results_Page GET [concat(parameters('CheckmarxASTBaseUrl'), '/api/sast-results/?scan-id=@{items(''For_Each_Scan'')?[''id'']}')]
HTTP_-_Send_SAST_Batch_to_DCR POST [concat(reference(resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('dataCollectionEndpointName'))).logsIngestion.endpoint, '/dataCollectionRules/', reference(resourceId('Microsoft.Insights/dataCollectionRules', variables('dataCollectionRuleName'))).immutableId, '/streams/', variables('streamName'), '?api-version=2023-01-01')]

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Playbooks