Fortify Application Security provides your team with solutions to empower DevSecOps practices, enable cloud transformation, and secure your software supply chain. As the sole Code Security solution with over two decades of expertise and acknowledged as a market leader by all major analysts, Fortify delivers the most adaptable, precise, and scalable AppSec platform available, supporting the breadth of tech you use and integrated into your preferred toolchain. We firmly believe that your great code demands great security, and with Fortify, go beyond 'check the box' security to achieve that.
This Fortify SSC parser plugin imports the results produced by the Fortify
Agentic Analyzer (FAA) — OpenText's AI-powered SAST capability that finds
vulnerabilities complementary to traditional data-flow SAST. The analyzer emits
its findings as SARIF 2.1.0; this plugin reads that SARIF and displays the
findings in Fortify Software Security Center (SSC) under the FORTIFY_AA engine
type.
The plugin is a lightly-customized derivative of Fortify's standard SARIF parser
plugin (fortify-ssc-parser-sarif),
tailored to the specific, fixed shape of FAA's SARIF output (Fortify taxonomy
categories, fortify-severity, stable instance fingerprints, and a single
canonical sink location per finding).
-
SARIF 2.1.0 only The plugin parses the SARIF 2.1.0 produced by the Fortify Agentic Analyzer. Other SARIF versions are rejected.
-
One engine type per application version Due to limitations in the SSC parser framework, results from different scan engines cannot be merged into a single SSC application version. Upload FAA results to an application version dedicated to the
FORTIFY_AAengine type.
- Usage: USAGE.md
- Releases: https://github.com/fortify/fortify-ssc-parser-faa/releases
- Development releases may be unstable or non-functional. The
*-thirdparty.zipfile is for informational purposes only and does not need to be downloaded.
- Development releases may be unstable or non-functional. The
- Sample input files: sampleData
- Source code: https://github.com/fortify/fortify-ssc-parser-faa
- Automated builds: https://github.com/fortify/fortify-ssc-parser-faa/actions
- Contributing Guidelines: CONTRIBUTING.md
- Code of Conduct: CODE_OF_CONDUCT.md
- License: LICENSE.txt
- SARIF specification: https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html
For general assistance, please join the Fortify Community to get tips and tricks from other users and the OpenText team.
OpenText customers can contact our world-class support team for questions, enhancement requests and bug reports. You can also raise questions and issues through your OpenText Fortify representative like Customer Success Manager or Technical Account Manager if applicable.
You may also consider raising questions or issues through the GitHub Issues page (if available for this repository), providing public visibility and allowing anyone (including all contributors) to review and comment on your question or issue. Note that this requires a GitHub account, and given public visibility, you should refrain from posting any confidential data through this channel.
This document was auto-generated from README.template.md; do not edit by hand