CheckmarxOne DAST Connector

The Checkmarx One DAST connector bridges application security scanning and enterprise risk management by automatically importing dynamic application testing findings into Qualys Enterprise TruRisk Management. Security teams gain centralized visibility into web application vulnerabilities discovered through simulated real-world attack scenarios, eliminating manual data transfers between platforms.

By consolidating these findings alongside other risk data, organizations can prioritize remediation efforts and understand how application vulnerabilities impact their overall security posture. The connector enables teams to activate web applications for continuous scanning within Qualys Web Application Security while maintaining a unified view of their application risk landscape.

Connector Details

Vendor	Checkmarx
Product Name	CheckmarxOne DAST
Category	Application Security
Findings Support	Yes
Supported Assets	Web Applications
Version	1.0.0
Integration Type	API Integration (REST)
Direction	Unidirectional
Delta Support	Not Supported

Configure the Connector

To configure the CheckmarxOne DAST connector in Qualys ETM:

1. Log in to your Qualys account and navigate to the Connectors module.
2. Select the Integrations tab, locate the CheckmarxOne DAST connector, and click Manage.
3. Click Proceed to Setup on the Setup Guide screen after reviewing the prerequisites.

Before You Begin - Authentication

Complete the following steps in your Checkmarx One environment before configuring the connector in Qualys ETM.

Generating an API Key in Checkmarx One

Reference: Creating API Keys – Checkmarx Docs

1. Log in to your Checkmarx One environment using the appropriate regional URL for your deployment.

   Select the base URL that matches your region:

   • US: Show URLShow URLhttps://ast.checkmarx.net
   • US2: Show URLShow URLhttps://us.ast.checkmarx.net
   • EU: Show URLShow URLhttps://eu.ast.checkmarx.net
   • EU2: Show URLShow URLhttps://eu-2.ast.checkmarx.net
   • DEU: Show URLShow URLhttps://deu.ast.checkmarx.net
   • ANZ: Show URLShow URLhttps://anz.ast.checkmarx.net
   • India: Show URLShow URLhttps://ind.ast.checkmarx.net
   • Singapore: Show URLShow URLhttps://sng.ast.checkmarx.net
   • UAE: Show URLShow URLhttps://mea.ast.checkmarx.net
   • Israel (Gov): Show URLShow URLhttps://gov-il.ast.checkmarx.net
2. Navigate to Settings > Identity and Access Management > API Keys.
3. Click Create Key.
4. Optionally configure a note description, expiration period, and notification email addresses.
5. Click Create and copy the generated API key immediately. Store it securely.

Identifying Your Domain Name and Tenant Name

Your Domain Name is the base URL of your Checkmarx One environment (for example, https://deu.ast.checkmarx.net). Your Tenant Name is the Tenant ID associated with your user profile. Both values are required when configuring the connector in Qualys ETM.

Permissions Required

The API key used for this connector must have the following permission assigned in Checkmarx One.

Entity Type	Permission
Vulnerability Findings	read:vulnerabilities

Scope and Data Access

The connector retrieves DAST scan results from the Checkmarx One environments, scans, and results API endpoints. Scan environments are fetched first, followed by scans per environment, and then individual scan results. Custom filtering is not supported during connector configuration. Applications appear in ETM, CSAM, and WAS after ingestion.

Key Rotation

When rotating the API key, generate a new key in Checkmarx One under Settings > Identity and Access Management > API Keys. Then update the credential in Qualys ETM by selecting the Edit Connector option and entering the new API key.

Create a Profile & Connection

Provide the connector name, description, and authentication credentials on this screen.

Connector Details

Field	Description
Connector Name	A unique display name for this connector instance.
Description	An optional description to identify the purpose of this connector.
Type of Findings	Select Web Application Vulnerabilities.

Authentication Details

Field	Type	Description
Domain Name	String	Base URL of your Checkmarx One environment. Example: https://deu.ast.checkmarx.net
Tenant Name	String	The Tenant ID associated with your Checkmarx One user profile.
API Key	Encrypted String	API key generated in the Checkmarx One console. Used to obtain an OAuth 2.0 access token.

 

After entering credentials, click Test Connection to validate connectivity before proceeding. The test verifies the following checks:

• Network Reachability
• TLS Handshake
• Authentication Credential Check
• Authorization Scope Check
• Data Fetch

Set the Scope & Schedule

The connector performs a full pull of all available DAST findings on each scheduled execution. Delta (incremental) synchronization is not supported.

1. Select the Transform Map to apply to ingested data.
2. Set connector Status to Active or Inactive.
3. Configure the Schedule:
   • Single Occurrence – runs once at the specified date and time.
   • Recurring – runs at a defined interval with configurable start and end dates.

Review the connector configuration summary before saving. Verify that the authentication type, domain, tenant, and schedule settings are correct. Click Create to create the connector.

Advanced Settings

Filters Tab

Custom filter queries are not currently supported for the CheckmarxOne DAST connector. The connector retrieves all available DAST scan results from the configured Checkmarx One environment on each run.

Transform Map Tab

The connector includes a default transformation map that maps Checkmarx One DAST source fields to Qualys ETM target fields. You may clone or create additional maps to customize field transformations for your environment.

CheckmarxOne DAST – Vulnerability MappingCheckmarxOne DAST – Vulnerability Mapping

How the Connection Works

The CheckmarxOne DAST connector ingests web application vulnerability findings from Checkmarx One DAST scans into Qualys ETM for unified risk analysis and prioritization. On each scheduled execution, the connector performs a full pull of DAST findings from Checkmarx One. Qualys ETM then processes the data by de-duplicating redundant entries, normalizing data formats, enriching findings with additional context, and calculating risk scores using TruRisk.

Ingested web applications appear in ETM, CSAM, and WAS after the first successful sync. This allows security teams to manage web application risk centrally and optionally activate applications for active scanning within WAS.

Connector States

A successfully configured connector progresses through the following states:

1. Registered – The connector is successfully created and registered to fetch data from Checkmarx One.
2. Scheduled – The connector is scheduled to execute a connection with the vendor.
3. Processing – A connection is active and the connector is fetching asset and findings data.
4. Processed – The connector has successfully fetched assets. Findings may still be processing; allow additional time for the import to complete.

Viewing Assets and Findings in ETM

After the connector reaches the Processed state, imported data is available in Qualys ETM.

1. Navigate to Enterprise TruRisk Management > Inventory.
   • Go to Assets > Web Applications to view imported Checkmarx applications.
   • Use the inventory filter: inventory:(source:"Checkmarx")

   

2. Navigate to Risk Management > Findings > Vulnerability.
   • Use the findings filter: findings.vendorProductname:"CheckmarxOne DAST"

   

Activating Web Applications in WAS

Web applications synced from the CheckmarxOne DAST connector appear in ETM, CSAM, and WAS. By default, these applications are not activated for scanning in WAS.

To activate web applications in WAS:

1. Navigate to CSAM > Web Applications.
2. Select the desired web application.
3. Choose Quick Actions > Activate WAS.

Troubleshooting

Issue	Resolution
Authentication failure on connector run	Verify the Domain Name, Tenant Name, and API Key entered in Qualys ETM are correct. Confirm the API key has not expired. Ensure the Domain Name matches your Checkmarx One regional deployment URL.
Connection test fails	Verify the Domain Name includes the correct regional prefix (for example, deu.ast.checkmarx.net). Confirm that the Qualys cloud can reach the Checkmarx One API endpoint over HTTPS (port 443).
No findings imported after first run	The connector transitions through Registered, Scheduled, Processing, and Processed states. The entire process may take up to 2 hours. Verify that Checkmarx One has completed DAST scans with results available. Delta synchronization is not supported; each run performs a full pull.

Additional Information

API Reference

The connector uses the following Checkmarx One API endpoints to retrieve DAST data:

Name	Endpoint	Notes
Authorization API	https://<domain>.checkmarx.net/auth/realms/<tenantId>/protocol/openid-connect/token	Grant type: client_credentials
Fetch Environments	https://<domain>.checkmarx.net/api/dast/scans/environments/	Example domain: deu.ast
Fetch Scans	https://<domain>.checkmarx.net/api/dast/scans/scans?environmentId=<environmentId>	Example environment ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Fetch Scan Results	https://<domain>.checkmarx.net/api/dast/mfe-results/results/<scanId>	Example scan ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx