External Scanners Supported
The xygeni report-upload command normalizes and uploads findings from third-party security tools to the Xygeni platform. The input reports are typically export formats (JSON, XML) and may follow common exchange formats like Static Analysis Results Interchange Format (SARIF) or GitLab’s Security Report Schemas.
The following is the list of third-party security scanners and report formats supported. The list of supported formats can also be listed by running the report-upload --show-formats command within the Xygeni scanner. Formats and tools are listed in alphabetical order. Xygeni does not endorse any vendor or tool.
Go to the report-upload command reference for the command syntax, and to Pull-mode fetch for the API-driven alternative to file uploads.
For per-category import walkthroughs (each with its own format table and pull-mode pointers), see:
SCA (Software Composition Analysis)
sca-sarif
<any>
Component vulnerabilities detected by a SCA tool, SARIF format
sca-appscan-asoc
HCL AppScan on Cloud / 360
AppScan on Cloud / 360 SCA report, in XML format
sca-checkmarx
Checkmarx SCA
CxSCA report, in JSON format
sca-checkmarx-one
Checkmarx One
SCA scanner of Checkmarx One, in JSON format
sca-checkmarx-one-results
Checkmarx One
SCA scanner of Checkmarx One, exported using 'cx results show'
sca-cyclonedx
<any>
CycloneDX SBOM, in JSON or XML format
sca-snyk
Snyk
Snyk SCA report, in JSON format
sca-sonatype
Sonatype Lifecycle (Nexus IQ)
Sonatype Lifecycle Policy Evaluation Report, in JSON format
sca-sonatype-cir
Sonatype Lifecycle (Nexus IQ)
Sonatype Lifecycle Component Information Report, in JSON format
sca-spdx
<any>
SPDX SBOM, in JSON or tag-value format
sca-trivy
Trivy
Trivy SCA report, in JSON format
sca-wiz-cli
Wiz CLI
Wiz CLI scan report (vulnerabilities), in JSON format
sca-wiz-cnapp
Wiz CNAPP
Wiz CNAPP vulnerability findings export, in JSON format
SAST (Software Application Security Testing)
sast-sarif
<any>
Code vulnerabilities detected by a SAST tool, in SARIF format
sast-appscan-xml
HCL AppScan Source
AppScan Source SAST report, in XML format (legacy referential format)
sast-appscan-asoc
HCL AppScan on Cloud / 360
AppScan on Cloud / 360 SAST report, in XML format
sast-brakeman
Brakeman
Brakeman SAST report for Ruby, in JSON format
sast-checkmarx
Checkmarx
CxSAST JSON report
sast-checkmarx-xml
Checkmarx
CxSAST XML report
sast-checkmarx-one
Checkmarx One
SAST scanner of Checkmarx One, in JSON format
sast-checkmarx-one-results
Checkmarx One
SAST scanner of Checkmarx One, exported using 'cx results show'
sast-fortify-fpr
Fortify
Fortify SAST report, in .fpr or .fvdl format
sast-fortify-xml
Fortify
Fortify SAST XML report
sast-kiuwan
Kiuwan
Kiuwan SAST XML report
sast-opengrep
OpenGrep
OpenGrep SAST report, in JSON format
sast-sonarcloud
SonarCloud
SonarCloud SAST JSON report
sast-sonarqube
SonarQube
SonarQube JSON report
For Kiuwan, exporting the findings to a local file needs special configuration, as documented in xygeni-extensions - Report upload for Kiuwan
AppScan SARIF output (AppScan Source v10.3+, AppScan on Cloud SAST, AppScan CodeSweep) is supported via the generic sast-sarif format with an AppScan-specific transformer — no separate format id is needed.
For Sonar, json report can be downloaded from issues/search endpoint at SonarCloud Web API GET api/issues/search, using the parameter additionalField=_all to get all additional fields from the project. If maximum number of issues exceed the limit (500), query should be paginated, …
IaC Flaws
iac-sarif
<any>
IaC vulnerabilities detected by a IaC tool, in SARIF format
iac-checkov
Checkov
Checkov IaC scanner, JSON format
iac-checkmarx
Checkmarx
IaC scanner of Checkmarx, in JSON format
iac-checkmarx-one
Checkmarx One
IaC scanner of Checkmarx One, in JSON format
iac-checkmarx-one-results
Checkmarx One
IaC scanner of Checkmarx One, exported using 'cx results show'
iac-kics
KICS
IaC vulnerabilities detected by KICS, in JSON format
iac-prisma-cloud
Prisma Cloud (CSPM)
Prisma Cloud CSPM security alerts, in JSON format
iac-wiz-config
Wiz CNAPP
Wiz CNAPP cloud configuration findings, in JSON format
iac-wiz-issues
Wiz CNAPP
Wiz CNAPP issues export, in JSON format
Secret Leaks
secrets-sarif
<any>
Secrets detected by a secrets tool, in SARIF format
secrets-gitleaks
GitLeaks
Secrets detected by GitLeaks, in JSON format
secrets-trufflehog
TruffleHog
Secrets detected by TruffleHog, in JSON-lines format
secrets-wiz-cli
Wiz CLI
Wiz CLI scan report (secrets), in JSON format
DAST (Dynamic Application Security Testing)
dast-acunetix-360
Acunetix 360
Acunetix 360 DAST report, in JSON format
dast-acunetix-xml
Acunetix
Acunetix DAST report, in XML format
dast-appscan-xml
HCL AppScan Standard/Ent.
AppScan Standard/Enterprise DAST report, in XML format (legacy referential)
dast-appscan-asoc
HCL AppScan on Cloud / 360
AppScan on Cloud / 360 DAST report, in XML format (flat format)
dast-xguardian
XGuardian
XGuardian DAST report, in XML format
dast-zap
OWASP Zap
ZAP DAST report, in XML or JSON format
Inventory
deps-cyclonedx
<any>
CycloneDX SBOM as dependency inventory, in JSON or XML format
deps-spdx
<any>
SPDX SBOM as dependency inventory, in JSON or tag-value format
inventory-prisma-cloud
Prisma Cloud (CSPM)
Prisma Cloud cloud asset inventory, in JSON format
inventory-trivy-k8s
Trivy
Trivy Kubernetes cluster inventory, in JSON format
inventory-wiz-cnapp
Wiz CNAPP
Wiz CNAPP cloud resources inventory, in JSON format
For native Kubernetes workload inventory (Deployments, StatefulSets, DaemonSets, Pods, Services, RBAC, NetworkPolicies, container images and their hierarchy) compatible with Xygeni's inventory.1 format, use the Kubernetes Inventory Exporter — a Python script in xygeni-extensions that produces an InventoryReport JSON ready for upload with report-upload --format inventory-xygeni.
CycloneDX and SPDX SBOMs are accepted both as dependency inventory (deps-cyclonedx, deps-spdx) and as SCA findings input (sca-cyclonedx, sca-spdx). Use the inventory form to register components without their vulnerabilities; use the SCA form to ingest vulnerabilities declared in the SBOM.
Last updated