CheckmarxOne SCA Connector

Have the following ready before starting the connector configuration in Qualys ETM:

1. Ensure you have access to your Checkmarx One environment with permissions to create API keys.
2. Generate an API key in Checkmarx One. Navigate to Settings > Identity and Access Management > API Keys and click Create Key. Store the generated key securely.
3. Note your Checkmarx region and Tenant Name (Tenant ID). Your region determines the base URL (for example, deu for the DEU region at https://deu.ast.checkmarx.net).

The connector authenticates using OAuth 2.0 with a client_credentials grant type. An API key generated from the Checkmarx One console is used alongside the Checkmarx region and Tenant Name to obtain an access token from the Checkmarx authorization endpoint. The token is then used for all subsequent API calls to retrieve projects and SCA scan results.

Generate an API Key in Checkmarx One

1. Log in to your Checkmarx One environment using the appropriate regional URL (see the region table below).
2. Navigate to Settings > Identity and Access Management > API Keys.
3. Click Create Key.
4. Optionally configure a description, expiration period, and notification emails.
5. Click Create and copy the generated API key immediately. Store it securely.

Read more about generating API keys at Creating OAuth Clients – Checkmarx Docs.

Identify Your Checkmarx Region and Tenant Name

Your Checkmarx region is extracted from your Checkmarx One base URL. Enter the full regional URL in the Checkmarx Region field in Qualys ETM.

Your Tenant Name is the Tenant ID associated with your Checkmarx One user profile.

Permissions Required

The API key must have read:vulnerabilities permission on the VulnerabilityFindings entity to access SCA vulnerability findings from Checkmarx One.

Scope and Data Access

The connector retrieves the latest completed SCA scan results for each project in Checkmarx One via the projects, last-scan, and scan results API endpoints. Custom filtering is not supported during connector configuration. The default asset class is Generic Application, and applications appear in ETM, CSAM, and WAS after ingestion. WAS activation consumes licenses; activate only the applications you need.

Key Rotation

When rotating the API key, generate a new key in Checkmarx One under Settings > Identity and Access Management > API Keys. Update the credential in Qualys ETM via the Edit Connector option and enter the new API key.

This step establishes the connector's identity and authenticates it with your Checkmarx One environment.

1. Log in to Qualys ETM.
2. Navigate to Connectors > Integration.
3. Locate the CheckmarxOne SCA Connector on the Connector Marketplace and click Add. This is a one-time task.

   Note: If the connector is already added, navigate to My Connectors, search for the CheckmarxOne SCA connector, and click Manage Connections.

4. From the connector tile, click Manage Connections.
5. Click Create Connection. The Setup Guide opens with the Before You Begin checklist and four reference tabs: Overview, Auth Setup, Permissions, and Troubleshooting. Review these before continuing.
6. Click Proceed to Setup.
7. On the Profile & Connectivity page, complete the following fields:

   Connector Details

   Field	Description
   Name (required)	A unique display name for this connector connection.
   Description	An optional description of the connection's purpose.

   Authentication Details

   Provide the following values to authenticate the connector with your Checkmarx One environment.

   Field	Type	Description
   Checkmarx Region (required)	String	The full base URL of your Checkmarx One environment. Example: https://deu.ast.checkmarx.net. See the regional URL table above.
   Tenant Name (required)	String	The Tenant ID associated with your Checkmarx One user profile. Example: qualys-nfr
   API Key (required)	Encrypted String	The API key generated from Checkmarx One under Settings > Identity and Access Management > API Keys.

   
   
   
8. Click Test Connection. A modal appears showing the status of five sequential checks:
   • Network Reachability — Verifies the Checkmarx One regional endpoint is reachable over HTTPS (port 443).
   • TLS Handshake — Confirms a secure connection can be established.
   • Authentication Credential Check — Validates the API key, Region, and Tenant Name against the Checkmarx OAuth endpoint.
   • Authorization Scope Check — Confirms the API key has read:vulnerabilities permission on the VulnerabilityFindings entity.
   • Data Fetch — Verifies that project and SCA scan data can be retrieved from the Checkmarx One API.

   Important: All five checks must pass before you can proceed. If Network Reachability fails with an Unknown Host error, verify that the Checkmarx Region value matches your deployment (for example, deu for the DEU region) and that Qualys cloud can reach the endpoint over HTTPS (port 443).

   
9. Click OK to dismiss the modal, then click Next.

This step defines what data is ingested and when the connector runs.

1. Data to Sync — This connector supports Assets only. SCA vulnerability findings are always ingested as part of the asset sync. The default asset class is Generic Application.
2. Advanced Settings (optional) — Click Advanced Settings to restrict which asset types are ingested or to view the active transform map. See Advanced Settings below.
3. Schedule — Select an execution frequency from the Occurs dropdown (for example, Daily). The system displays the calculated start date, end date, and timezone.

   Note: The timezone is determined by your Qualys account settings. The connector runs from the configured start date for a default period of 5 years.

4. Click Next.
   
5. Review your changes and confirm. Save the connection.