Manage Third-Party Data Ingestion

By ingesting Static Application Security Testing (SAST) findings directly from third-party sources, Application Security expands its security coverage, allowing you to gain visibility into and effectively manage SAST violations across your organization. The platform also provides suggested remediation steps to help you quickly address identified vulnerabilities. These capabilities, combined with Application Security’s native IaC, SCA and Secrets scanner management and other domains, provide a comprehensive security management platform for your applications.

SAST scans analyze the source code of an application to identify security vulnerabilities, coding errors, and weaknesses. SAST CWE violations refer to security vulnerabilities identified by SAST tools that align with the Common Weakness Enumeration (CWE) list. Refer to the MITRE CWE website for more information about CWEs.

Before you begin, integrate your third-party data sources to ingest SAST data findings. Refer to ../../get-started/connect-code-and-build-providers/third-party-ingestion/third-party-ingestion.adoc[Third-Party Ingestion] for more information.

Manage Code Weaknesses

Code weaknesses generated by ingested findings are displayed on the Application Security Dashboard, Projects and Repositories pages.

Code Weaknesses on Dashboard

To view ingested Code weaknesses on your dashboard:

1. Create a custom dashboard.
2. Drag the required widgets onto the dashboard.
3. Click the edit icon on a dashboard widget.
4. Select 3rd Party Weaknesses in the Code Category field.
5. Select Save Settings.

   Your code weaknesses are displayed on the widget.

Default widgets are pre-populated with data.

Code Weaknesses on Projects

To view ingested CWE weaknesses on the Projects page:

1. Navigate to the Projects page and choose one of the following options:

   • Select the 3rd Party Weaknesses tab to view an inventory of ingested CWE weaknesses
   • The Overview tab, displayed by default, displays all issues detected by Prisma Cloud, including ingested 3rd party weaknesses. To only view SAST issues on the Overview tab, select 3rd Party Weaknesses under the Code Categories tab

     The table displays a list of findings, including details such as the violated policy, when first detected, the type of vulnerability (CWE), and the location of the finding. You can filter the table using 'Group by Policy' or 'Group by Resource', which displays the file including the weakness.
2. Click on a CWE finding to open a sidecar with additional information, including the third-party vendor policy that was violated and its description (for native ingestion). Additionally you can see the data that the violation is based on, including the file, line and function.

   Clicking on the link in the Source field opens the finding in the vendor’s tool.

Code Weaknesses on Repositories

The Issues column of the Repositories page displays the total sum of SAST CWE weaknesses detected from all sources, including all third-party data ingestion. Clicking on SAST redirects to the Projects page. Refer to Findings in Projects above for more information.

For more information on SAST scan management on Prisma Cloud console, refer to Monitor and Manage Code Build Issues.