Checkmarx

---
name: checkmarx
description: "Expert agent for Checkmarx One unified AppSec platform. Covers SAST, SCA, DAST, IaC scanning, API security, CxQL custom rules, incremental scanning, results correlation, KICS, and CI/CD integration. WHEN: \"Checkmarx\", \"CxOne\", \"CxSAST\", \"CxQL\", \"KICS\", \"Checkmarx One\", \"Cx flow\", \"incremental scan\", \"Checkmarx IaC\", \"Checkmarx AI Security\"."
license: MIT
---

# Checkmarx One

This skill covers Checkmarx One, the unified application security platform. It covers SAST, SCA, DAST, API Security, IaC Security, and Supply Chain security within the Checkmarx One platform, as well as the legacy Checkmarx SAST (CxSAST) product.

## How to Approach Tasks

1. **Identify product generation** -- Checkmarx One (cloud-native, current) vs. CxSAST (legacy on-premise). Most new deployments use Checkmarx One.
2. **Identify the engine:**
   - SAST -- Source code scanning
   - SCA -- Open source dependencies
   - DAST -- Runtime scanning
   - IaC -- Infrastructure as code (Terraform, CloudFormation, K8s)
   - API Security -- API posture and testing
   - Supply Chain -- Package provenance and integrity
3. **Classify the task:** Setup, scan configuration, results review, custom rules (CxQL), CI/CD integration, remediation guidance.

## Checkmarx One Platform Overview

Checkmarx One is a SaaS-first unified AppSec platform that consolidates multiple security testing types under a single interface, single API, and correlated results view.

**Tenant model:** Cloud tenants per region (US, EU, Singapore). Single sign-on via SAML/OIDC. Projects, groups, and applications organize the asset inventory.

**Applications:** A logical grouping of related projects (e.g., "Payment Service" application contains frontend, backend, and infrastructure projects). Risk scores aggregate at application level.

## SAST Engine

### Language Support

35+ languages including:
- **Tier 1 (deep analysis):** Java, C#, C/C++, JavaScript/TypeScript, Python, PHP, Go, Kotlin, Swift, Ruby, Scala
- **Tier 2:** APEX, Cobol, Groovy, Perl, PL/SQL, T-SQL, VB.NET, VBScript, RPG
- **IaC via KICS:** Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, Ansible

### Incremental Scanning

Checkmarx One supports incremental scanning — only analyzing changed files since the last full scan. This dramatically reduces scan time for large codebases:

- **Full scan:** Complete codebase analysis. Run on baseline, main branch merges.
- **Incremental scan:** Only modified files. Run on PRs and feature branches.
- **Fast scan:** Subset of rules optimized for speed, used in developer workflows.

```yaml
# CxConfig.yaml — project configuration
scan:
  type: incremental   # full | incremental | fast
  preset: Checkmarx Default
  branch: main
```

### Scan Presets

Presets are rule sets for SAST. Built-in presets:

| Preset | Description |
|---|---|
| Checkmarx Default | Comprehensive security ruleset (recommended) |
| High and Medium | Only High/Medium severity rules |
| OWASP Top 10 | Rules mapped to OWASP 2021 |
| PCI DSS | Rules for PCI compliance |
| SANS Top 25 | Rules for SANS/CWE Top 25 |

Custom presets can be created in the UI or via API.

### Results and Triage

SAST results are categorized by:
- **Severity:** Critical, High, Medium, Low, Info
- **State:** To Verify, Confirmed, Not Exploitable, Proposed Not Exploitable
- **Status:** New, Recurring, Resolved, Ignored

**Triage workflow:**
1. Review finding with full data flow (source → propagation → sink)
2. Mark as "Confirmed" (real vulnerability) or "Not Exploitable" (false positive)
3. Assign to developer for remediation
4. Set SLA-based due date
5. Track in Checkmarx One dashboard

"Not Exploitable" state persists across scans — the same false positive will not resurface as "New" on the next scan.

## CxQL (Checkmarx Query Language)

CxQL is a proprietary query language for writing custom SAST rules. It operates on the code graph — AST nodes, data flow paths, and method calls.

### CxQL Fundamentals

```csharp
// CxQL syntax (C#-like)
// Find SQL queries built with string concatenation from HTTP params
CxList httpParams = Find_Inputs();
CxList sqlQueries = Find_SQL_Queries();

// Find paths from HTTP input to SQL queries
CxList paths = sqlQueries.DataInfluencedBy(httpParams);

result = paths;
```

**Core CxQL methods:**

| Method | Purpose |
|---|---|
| `Find_Inputs()` | All external data sources |
| `Find_SQL_Queries()` | All SQL execution points |
| `Find_By_Name(name)` | All nodes with given name |
| `Find_By_Type(type)` | All nodes of given type |
| `DataInfluencedBy(src)` | Nodes influenced by src through data flow |
| `InfluencedBy(src)` | Nodes influenced by src (data or control flow) |
| `GetByAncs(ancestor)` | Nodes that are descendants of ancestor |
| `GetParameters()` | Parameters of method calls |
| `FindByShortName(name)` | Find by partial name match |

**Sanitizer exclusion:**
```csharp
// Exclude paths that pass through a sanitizer
CxList sanitizers = Find_By_Name("MySanitizeMethod");
CxList paths = sqlQueries.DataInfluencedBy(httpParams)
    .ExcludeIfInfluencedBy(sanitizers);
result = paths;
```

### Custom Query Deployment

1. Navigate to Checkmarx One → Presets → Custom Queries
2. Create query (CxQL editor with syntax highlighting)
3. Test against sample project
4. Assign to preset
5. Assign preset to project

Corporate queries can be scoped to:
- **All projects:** Corporate-level
- **Team projects:** Team-level
- **Single project:** Project-level (override)

## KICS (Keeping Infrastructure as Code Secure)

KICS is Checkmarx's open-source IaC scanner (available at github.com/Checkmarx/kics). Integrated into Checkmarx One for enterprise use.

**Supported platforms:**
- Terraform (AWS, Azure, GCP providers)
- AWS CloudFormation / CDK
- Azure Resource Manager
- Kubernetes / Helm
- Dockerfile
- Ansible
- Google Deployment Manager
- Pulumi

**Rule count:** 2,400+ queries across all platforms (as of 2026)

**Running KICS standalone:**
```bash
# Docker
docker run -v $(pwd):/path checkmarx/kics:latest scan \
  -p /path/terraform \
  -o /path/results \
  --report-formats json,sarif

# Binary
kics scan -p ./infrastructure/ \
  -o ./kics-results \
  --report-formats html,json \
  --exclude-severities info
```

**KICS in GitHub Actions:**
```yaml
- name: KICS IaC Scan
  uses: checkmarx/kics-github-action@v2.1
  with:
    path: './terraform'
    output_formats: 'json,sarif'
    fail_on: high,medium
```

**SARIF output integration:** KICS outputs SARIF 2.1.0, which GitHub Security tab displays natively via `upload-sarif` action.

## Results Correlation

Checkmarx One correlates findings across engines — if the same vulnerability appears in SAST, SCA, and DAST, it surfaces as a single correlated result with multiple evidence points.

**Correlation logic:**
- Same CVE or CWE across multiple engines
- Same file/component touched by multiple finding types
- Same application risk aggregated across finding types

**Value:** Reduces duplicate tickets, helps prioritize — a vulnerability with SAST evidence (code-level) + DAST evidence (runtime-confirmed) is definitively exploitable, not theoretical.

## CI/CD Integration

### Checkmarx One CLI (cx)

```bash
# Install
curl -L https://github.com/Checkmarx/ast-cli/releases/latest/download/ast-cli_linux_x64.tar.gz | tar xz

# Authenticate
cx configure --base-uri $CX_BASE_URI --client-id $CX_CLIENT_ID --client-secret $CX_CLIENT_SECRET

# Run scan
cx scan create \
  --project-name "my-app" \
  --source . \
  --scan-types sast,sca \
  --branch main \
  --report-format sarif \
  --output-path results/
```

### GitHub Actions

```yaml
- name: Checkmarx One Scan
  uses: checkmarx/ast-github-action@main
  with:
    base_uri: ${{ vars.CX_BASE_URI }}
    cx_client_id: ${{ secrets.CX_CLIENT_ID }}
    cx_client_secret: ${{ secrets.CX_CLIENT_SECRET }}
    project_name: ${{ github.repository }}
    branch: ${{ github.ref_name }}
    scanners: sast,sca
    incremental: true   # incremental scan for PRs
```

### CxFlow (Legacy Integration Tool)

CxFlow is a workflow integration tool for legacy CxSAST deployments. It:
- Watches for webhooks from GitHub/GitLab/Azure DevOps
- Triggers scans automatically
- Routes results to issue trackers (Jira, GitHub Issues, ServiceNow)

In Checkmarx One, CxFlow is replaced by native integrations and the cx CLI.

## Checkmarx AI Security

AI-powered features in Checkmarx One (2025+):

- **AI Query Builder:** Describe a vulnerability in plain English; Checkmarx generates CxQL
- **AI Remediation:** Generates fix suggestions for confirmed vulnerabilities with context-aware code changes
- **AI Risk Prioritization:** Uses exploit intelligence to prioritize findings beyond CVSS
- **Checkmarx AI Security Insights:** LLM-powered analysis of AI-generated code for security issues (AI-written code has distinct vulnerability patterns)

## Policy and Compliance

**Policies in Checkmarx One:**
- Define break-build conditions (e.g., any Critical SAST finding → fail pipeline)
- Map to compliance frameworks (PCI DSS, HIPAA, SOC 2, ISO 27001)
- Set SLA thresholds per severity

```json
// Policy rule example
{
  "name": "Block on Critical",
  "condition": {
    "engine": "sast",
    "severity": "critical",
    "state": ["TO_VERIFY", "CONFIRMED"],
    "count_threshold": 0
  },
  "action": "break_build"
}
```

## Common Troubleshooting

**Scan stuck in "Running" state:**
- Check scan queue in Administration → Scans
- Large monorepos: may need to increase timeout settings
- Network issues uploading large repositories: use `--async` flag and poll status

**High false positive rate on Java:**
- Ensure compiled classes are available (`sonar.java.binaries` equivalent: include `.class` files or Maven/Gradle build output)
- Review sanitizer configurations in custom queries
- Apply preset filters to exclude known FP-prone rules

**Incremental scan missing issues:**
- Ensure baseline scan (full scan) exists for the branch
- Incremental only compares to last full scan of same branch

**SCA not detecting dependencies:**
- Verify package manager files are present (pom.xml, package.json, go.mod, etc.)
- For lockfiles: ensure package-lock.json / yarn.lock / go.sum are committed
- Enable recursive scanning for monorepos with multiple package manifests