CheckmarxOne SAST Connector

Have the following ready before starting the connector configuration in Qualys ETM:

1. Ensure you have access to your Checkmarx One environment with permissions to create API keys.
2. Generate an API key in Checkmarx One. Navigate to Settings > Identity and Access Management > API Keys and click Create Key. Store the generated key securely.
3. Note your Checkmarx region URL and Tenant Name (Tenant ID). Your region determines the base URL (for example, eu.ast.checkmarx.net for EU or ast.checkmarx.net for US).
4. Contact your Technical Account Manager (TAM) or Qualys Support to activate the connector for your subscription.

Generate an API Key in Checkmarx One

1. Log in to your Checkmarx One environment using the appropriate regional URL (see the region table below).
2. Navigate to Settings > Identity and Access Management > API Keys.
3. Click Create Key.
4. Optionally configure a note description, expiration period, and notification emails.
5. Click Create and copy the generated API key immediately. Store it securely.

Reference: Creating OAuth Clients – Checkmarx Docs

Checkmarx One Regional URLs

Use the URL that corresponds to your Checkmarx One deployment region. Enter this full URL as the Checkmarx Region field in Qualys ETM.

Permissions Required

The API key must have read access to vulnerabilities in Checkmarx One. The required permission is read:vulnerabilities on the VulnerabilityFindings entity type.

Scope and Data Access

The connector retrieves the latest completed SAST scan results for each project in Checkmarx One. Data is fetched from the projects and scan results API endpoints. Custom filtering is not supported during connector configuration. The default asset class is Generic Application, and applications appear in ETM, CSAM, and WAS after ingestion (not activated by default in WAS).

Key Rotation

When rotating the API key, generate a new key in Checkmarx One under Settings > Identity and Access Management > API Keys. Update the credential in Qualys ETM via the Edit Connector option and enter the new API key. If an expiration period was configured on the key, rotate before expiry to maintain uninterrupted data ingestion

This step establishes the connector's identity and authenticates it with your Checkmarx One environment.

1. Log in to Qualys ETM.
2. Navigate to Connectors > Integration.
3. Locate the CheckmarxOne SAST Connector on the Connector Marketplace and click Add. This is a one-time task.

   Note: If the connector is already added, navigate to My Connectors, search for the CheckmarxOne SAST connector, and click Manage Connections.

4. From the connector tile, click Manage Connections.
5. Click Create Connection. The Setup Guide opens with the Before You Begin checklist and four reference tabs: Overview, Auth Setup, Permissions, and Troubleshooting. Review these before continuing.
6. Click Proceed to Setup.
7. On the Profile & Connectivity page, complete the following fields:

   Connector Details

   Field	Description
   Name (required)	A unique display name for this connector connection.
   Description	An optional description of the connection's purpose.

   Authentication Details

   Provide the following values to authenticate the connector with your Checkmarx One environment.

   Field	Type	Description
   Checkmarx Region (required)	String	The base URL of your Checkmarx One environment. Example: https://deu.ast.checkmarx.net. See the regional URL table above.
   Tenant Name (required)	String	The Tenant ID associated with your Checkmarx One user profile. Example: qualys-nfr
   API Key (required)	Encrypted String	The API key generated from Checkmarx One under Settings > Identity and Access Management > API Keys.

   
   
8. Click Test Connection. A modal appears showing the status of five sequential checks:
   • Network Reachability — Verifies the Checkmarx One regional endpoint is reachable over HTTPS (port 443).
   • TLS Handshake — Confirms a secure connection can be established.
   • Authentication Credential Check — Validates the API key, Region, and Tenant Name against the Checkmarx OAuth endpoint.
   • Authorization Scope Check — Confirms the API key has read:vulnerabilities permission on the VulnerabilityFindings entity.
   • Data Fetch — Verifies that project and scan data can be retrieved from the Checkmarx One API.

   Important: All five checks must pass before you can proceed. If Network Reachability fails with an Unknown Host error, verify that the Checkmarx Region value matches your deployment (for example, https://deu.ast.checkmarx.net for the DEU region) and that Qualys cloud can reach the endpoint over HTTPS (port 443).

   
9. Click OK to dismiss the modal, then click Next.

This step defines what data is ingested and when the connector runs.

1. Data to Sync — This connector supports Assets only. Assets & Findings is not available as a separate radio option; findings are always ingested as part of the asset sync.
2. Advanced Settings (optional) — Click Advanced Settings to restrict which asset types are ingested or to view the active transform map. See Advanced Settings below.
3. Schedule — Select an execution frequency from the Occurs dropdown (for example, Daily). The system displays the calculated start date, end date, and timezone.

   Note: The timezone is determined by your Qualys account settings. The connector runs from the configured start date for a default period of 5 years.

4. Click Next.