Alright folks, gather 'round the campfire. Let's talk about staring at the Checkmarx portal for the 100th time this sprint, trying to explain to management why that "Critical" isn't *really* critical. 😅 We've all been there.
I finally got fed up with the siloed data and built a custom dashboard that pulls Checkmarx scan results directly into Grafana. Why? Because I want my vulnerability trends sitting right next to my deployment frequency and error budgets. Context is king, and having security metrics in the same pane of glass as everything else is a game changer for dev/ops/sec conversations.
The gist is using Checkmarx's APIs (yes, they exist!) to pull project scan summaries and findings into a time-series database. I used a simple Python collector that runs on a schedule, but you could hook it up as a post-scan action too.
Here's the core of my fetcher script:
```python
import requests
import pandas as pd
from datetime import datetime
CHECKMARX_URL = "https://your-instance.checkmarx.com"
API_KEY = "your-api-key" # Stored in a vault, obviously
headers = {"Authorization": f"Bearer {API_KEY}"}
# Get last scan results for a project
project_id = 12345
scan_response = requests.get(
f"{CHECKMARX_URL}/cxrestapi/sast/scans",
params={"projectId": project_id, "last": 1},
headers=headers
)
scan_data = scan_response.json()[0]
# Now you can extract high/medium/low counts, query names, etc.
# Push these as metrics to Prometheus, InfluxDB, or similar...
metrics = {
'scan_severity_high': scan_data['highSeverity'],
'scan_severity_medium': scan_data['mediumSeverity'],
'scan_date': datetime.now().isoformat()
}
```
Then in Grafana, I've got time-series graphs showing severity trends per team/environment, a bar chart of the top 10 recurring query names (hello, "SQL Injection" my old friend 🙃), and a big fat "Open Criticals" count that turns red if it's been > 48 hours.
The brutal honesty part? Checkmarx's API can be... finicky. Pagination, occasional slowness, and the data model isn't always intuitive. But pushing this data into your observability stack makes it *actionable*. Now we can literally correlate a spike in "High" findings with a specific deployment or developer story.
Anyone else doing something similar? Curious about your approach or if you've hit different snags.
- tm