--- sourceDocument: Australia IT Service Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-service-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Service Management ft:clusterId : - itsm bundleId : - itsm workflow : - Technology --- # Checkmarx # Checkmarx integration with DevOps Change Velocity {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Checkmarx integration with DevOps Change Velocity This integration connects your Checkmarx instance, which is integrated with CI/CD pipelines, to ServiceNow DevOps Change Velocity. It enables automatic retrieval of security scan results, helping you assess the vulnerability of your code within your DevOps workflows. Show full answer Show less Checkmarx scans configured on GitHub Actions, Jenkins, Azure DevOps, GitLab, and Harness pipelines are supported. Two Checkmarx tools can be integrated: Checkmarx One and Checkmarx SAST. Note that Checkmarx One integration supports only Static Application Security Testing (SAST) scans, excluding Software Composition Analysis (SCA) scans. ## Key Features * **Pipeline compatibility:** Supports scans from various CI/CD tools including GitHub Actions, Jenkins, Azure DevOps, GitLab, and Harness. * **Role and permission requirements:** Checkmarx SAST users need roles with permissions to read Project and Scan Results. Checkmarx One users require create-scan and manage-project roles. * **Pipeline configuration:** Custom action code must be added in Azure DevOps and GitHub Actions pipelines. For Jenkins, if using Checkmarx One, no custom action is needed if the scan step is present; for Checkmarx SAST, custom action code is always required. * **GitLab and Harness integration:** Use generic Docker container images to add Checkmarx security scan steps. * **Visibility of scan results:** Security scan results are viewable in the Change Request related list, Task Execution of the pipeline, or Pipeline UI within ServiceNow. * **Change automation:** Security results can be used to define change policies and conditions for automating change processes. ## Getting Started * Install the necessary plugins: **DevOps Vulnerability Integrations (sndevopsvulints)** plus either **Checkmarx One Vulnerability Integration (xchec3chexone)** or **Checkmarx CxSAST Vulnerability Integration (xchec3cxsast)**. * The **snvul.appsecmanager** role is automatically added to the DevOps Tool Owner role when the DevOps Vulnerability Integrations plugin is installed. * Onboarding options include a guided workspace playbook, the ServiceNow Service Catalog, or the Classic experience, allowing flexible integration setup based on your preference. ## Practical Benefits This integration streamlines security vulnerability management by embedding Checkmarx scan results directly into your ServiceNow DevOps Change Velocity environment. It enables proactive security assessments during development pipelines, supports compliance with security policies, and enhances change automation with security insights, helping you reduce risk and accelerate secure software delivery. Connect to your Checkmarx instance that is integrated with your CI/CD pipelines to retrieve security scan results. This helps you determine how vulnerable your code is. ## Checkmarx integration overview {#checkmarx-integration-with-devops-change-velocity__section_fuf_jqg_bqb} Checkmarx scans that are configured on GitHub Actions, Jenkins, Azure DevOps, GitLab, and Harness pipelines are supported in DevOps Change Velocity. Two Checkmarx tools can be integrated with DevOps Change Velocity, which are Checkmarx One and Checkmarx SAST. For more information, see [Checkmarx One](https://checkmarx.com/resource/documents/en/34965-68518-introduction.html) and [Checkmarx SAST](https://checkmarx.com/resource/documents/en/34965-46311-checkmarx-sast-overview.html) documentation. Ensure that your Checkmarx SAST user has a role that has permissions to read Project and Scan Results to get summary details. For more information, see [Checkmarx documentation](https://checkmarx.atlassian.net/wiki/spaces/KC/pages/1178009601/CxSAST+CxOSA+Roles+and+Permissions+v9.0.0+and+up). Ensure that your Checkmarx One user has the create-scan and manage-project roles to access Scan summary details. For more information, see [Checkmarx documentation](https://checkmarx.com/resource/documents/en/34965-68603-managing-roles.html). Note: If you are integrating with Checkmarx One, you can retrieve only Static Application Security Testing (SAST) scans but not Software Composition Analysis (SCA) scans. You can configure Checkmarx scans on any stage of the pipeline and the scan details are retrieved from the corresponding stage to DevOps Change Velocity. If you're using Azure DevOps or GitHub Actions orchestration tools, then you must add the custom action code in your pipeline always. If you're using Jenkins, and your pipeline already has a Checkmarx One security scan (checkmarxASTScanner) step, you don't have to add the custom action code in your pipeline. For Checkmarx SAST, the custom action code must be added in your pipeline even if it has the security scan step (checkmarxASTScanner). If you want to configure Checkmarx for the GitLab tool, you can use the generic Docker container image to add the Checkmarx security step or perform the steps specified in the [Integrate security tools with GitLab](https://www.servicenow.com/docs/_Ei_m2ZDQ12JaIrx4Nm5eQ "Configure security tool for GitLab which is not supported in the base system.") topic. For Harness pipelines, you can configure Checkmarx scans only through the generic Docker Container Image. For more information, see [Implement custom actions for pipelines using Docker image](https://www.servicenow.com/docs/lyDd5Y1L9yyAuDzJFwe0tg "Use the ServiceNow custom actions to collect data related to change request creation, Sonar scan, artifact registration, and package registration in your pipeline with the help of the generic Docker Container Image."). You can view the security scan results in the related list of a Change Request, or the Task Execution of the pipeline, or in the Pipeline UI in your ServiceNow instance. You can also use security results in defining change policies and conditions for change automation. ## Get started {#checkmarx-integration-with-devops-change-velocity__section_fps_jhy_xxb} You must install the DevOps Vulnerability Integrations (sn_devops_vul_ints) and Checkmarx One Vulnerability Integration (x_chec3_chexone) or Checkmarx CxSAST Vulnerability Integration (x_chec3_cxsast) plugins before connecting your Checkmarx instance to ServiceNow. For more information on activating a plugin, see [Install a ServiceNow Store application](https://www.servicenow.com/docs/access?context=t_InstallApplications&version=australia&pubname=australia-platform-administration&ft:locale=en-US). Note: The sn_vul.app_sec_manager role is added to the DevOps Tool Owner \[sn_devops.tool_owner\] role when the DevOps Vulnerability Integrations plugin (sn_devops_vul_ints) is installed. For more information on the scan results captured in ServiceNow, see [Security scan results](https://www.servicenow.com/docs/lFOZN4q9l4hz~6IV6W6Kfw "Security scan results display scan details from security scans configured on your GitHub Actions, Jenkins, Azure DevOps, GitLab, or Harness pipelines."). Use one of the following options to onboard Checkmarx. For a guided experience, use the workspace to onboard a tool. Alternatively, you can use the Service Catalog or Classic experience. * **[Onboard Checkmarx to DevOps Change Velocity - Workspace](https://www.servicenow.com/docs/fXTronflA4H8NhX_6L_7iw)** Connect to your Checkmarx instance using the DevOps Change Workspace playbook. * **[Onboard Checkmarx to DevOps Change Velocity - Service Catalog](https://www.servicenow.com/docs/ZljJgnFTUrIvV1wVuyIL6A)** Connect your Checkmarx instance using the ServiceNow Service Catalog. * **[Onboard Checkmarx to DevOps Change Velocity - Classic](https://www.servicenow.com/docs/xg8u4uSVeTorU5iE9VM0Nw)** Connect to your Checkmarx instance to retrieve scan results.