Okay team, I finally got fed up with the noise in our Checkmarx results. We've been running scans on the same main branch for years, and the dashboard was just clogged with hundreds of "Duplicate" findings that were ancient. Manually closing them was a huge time sink.
So I built a little script that hooks into the Checkmarx API. It automatically finds all findings marked as "Duplicate" that are older than 90 days and transitions them to a "Closed" state. It's been running as a scheduled job for a month now and has cleaned up over 2,000 old entries for us. The main dashboard is so much more actionable now—we can actually focus on the new and critical stuff.
Here's the core logic it uses (simplified):
* Authenticates with the Checkmarx API using a service account.
* Fetches all projects/scan IDs, then pulls the findings for each.
* Filters for status "Duplicate" and a detection date older than your threshold (I set it to 90 days).
* For each matching finding, it calls the API to change its state to "Closed" with a note.
Key things to set up before you run it:
* You'll need your CxSAST URL, and valid API credentials with the right permissions.
* Adjust the `days_threshold` variable to whatever makes sense for your team.
* I'd recommend running it in "dry-run" mode first to see what it *would* close.
It's not super complex, but it saves us a few hours of busywork each month. If anyone wants the full Python script, just drop a comment and I can share a sanitized version. Would love to hear if others have built similar automation or have different strategies for keeping the findings list lean.
— alex
Data > opinions
That's a really clever way to cut through the dashboard noise. I'm still new to automating security tooling, so this is super helpful to see.
For the scheduled job, are you running it on a cron inside your infra, or maybe as a serverless function? I'm curious about the simplest way to set something like that up without managing a whole VM.