Used by
OpenAna + Checkmarx
SAST findings from Checkmarx and Checkmarx One, connected live or imported.
Live connectionSecurity testing
Ana + Checkmarx
What Ana does with it.
Findings Ana pulls live or imports, de-duplicates, ranks by real exposure and turns into fixes.
- 01
De-duplicates SAST findings across scans
- 02
Confirms reachability before fixing
- 03
Patch PRs with regression tests
Setup
Connected in four steps.
- 1
Connect
Open Integrations in Ana and connect Checkmarx with a scoped token, OAuth app or service account.
- 2
Scope it
Start read-only and choose which projects, repositories or accounts Ana can see.
- 3
Set the rules
Decide which actions need approval and who approves them - Ana’s guardrails enforce it.
- 4
Put it to work
Ana uses Checkmarx in investigations, fixes and reports, and every action is logged.
In practice
Playbooks that use Checkmarx.
Security
Turning a pentest report into merged fixes
A penetration test lands as a PDF with dozens of findings. Ana parses it, confirms which findings are reachable in your code and cloud, writes the fixes with regression tests, and hands the auditor evidence for every closure.
Read the playbook →Security
Clearing a dependency CVE backlog
Your SCA tool reports thousands of vulnerable dependencies and the number never goes down. Ana works out which are actually reachable, upgrades them safely with tests, and documents why the rest can wait.
Read the playbook →Governed
Every action, approved and logged.
Ana’s guardrails decide what it may do with Checkmarx, route sensitive actions to named approvers, and keep evidence for each decision. OpenAna is SOC 2 Type II, ISO 27001, HIPAA and GDPR compliant.
FAQ
OpenAna and Checkmarx.
No. Ana works with Checkmarx - it turns what the tool finds into verified fixes - so you keep the tool you already run.
Security testing
Also in this category.
See it connected
Ana on your Checkmarx.
Thirty minutes, your real setup, one real problem.