---
sourceDocument: Australia IT Service Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-service-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Service Management

ft:clusterId :

    - itsm

bundleId :

    - itsm

workflow :

    - Technology


---

# Configure Checkmarx scans on your pipeline

# Configure Checkmarx scans on your pipeline {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Configure Checkmarx scans on your pipeline

This guide explains how ServiceNow customers can integrate Checkmarx security scans into their CI/CD pipelines using various orchestration tools such as Azure DevOps, Jenkins, GitHub Actions, GitLab, and Harness.
It enables automated retrieval and reporting of Checkmarx scan results into ServiceNow DevOps Change Velocity, enhancing security visibility within your development process.
Show full answer Show less  

## Key Features

* **Multi-tool support:** Configure Checkmarx scans on pipeline stages across Azure DevOps, Jenkins, GitHub Actions, GitLab, and Harness.
* **Scan types:** Supports both Checkmarx One and Checkmarx SAST scans with specific configuration attributes per tool.
* **Custom action code:** Required custom action snippets for Azure DevOps, GitHub Actions, and Jenkins pipelines enable integration with ServiceNow.
* **Docker image usage:** For GitLab and Harness pipelines, Checkmarx scans are configured using a generic Docker container image, allowing flexibility with containerized pipeline steps.
* **Security results attributes:** Configuration involves passing scanner type, project identifiers, scan IDs (optional for Checkmarx One), and ServiceNow onboarded security tool IDs to ensure correct association of scan results.

## Configuration Highlights by Orchestration Tool

* **Azure DevOps:** Add the ServiceNow DevOps Security Results task in your .yml pipeline definition with parameters for Checkmarx One or SAST including project IDs and optional security tool IDs.
* **Jenkins:** Use the Pipeline Syntax generator to add the `snDevOpsSecurityResult` step with relevant Checkmarx scan attributes. Custom action code is mandatory for SAST scans.
* **GitHub Actions:** Insert the ServiceNow DevOps Security Results custom action in your workflow .yml file, providing secrets for authentication and specifying scan attributes for Checkmarx One or SAST.
* **GitLab:** Use the generic Docker container image or follow the specific integration steps for GitLab to add Checkmarx scanning stages.
* **Harness:** Configure Checkmarx scans exclusively through the generic Docker container image with a custom script that posts scan results to ServiceNow.

## Benefits and Outcomes

* Automates the integration of Checkmarx security scan results into ServiceNow DevOps Change Velocity, allowing centralized security assessment tracking.
* Enhances pipeline security visibility by linking scan data to specific pipeline stages and projects.
* Supports multiple CI/CD tools, enabling flexible adoption within diverse development environments.
* Standardizes the reporting format and simplifies management of security scan results across tools and pipeline architectures.  
Configure Checkmarx scans on your Azure DevOps, Jenkins, GitHub, GitLab, or Harness pipelines.

You can configure Checkmarx scans on any stage of the pipeline and the scan details are retrieved from the corresponding stage to DevOps Change Velocity. If you're using Azure DevOps or GitHub Actions orchestration tools, then you must
add the custom action code in your pipeline always. If you're using Jenkins, and your pipeline already has a Checkmarx One security scan (checkmarxASTScanner) step, you don't have to add the custom action code in your pipeline. For
Checkmarx SAST, the custom action code must be added in your pipeline even if it has the security scan step (checkmarxASTScanner).

If you want to configure Checkmarx for the GitLab tool, you can use the generic Docker container image to
add the Checkmarx security step or perform the steps specified in the [Integrate security tools with GitLab](https://www.servicenow.com/docs/_Ei_m2ZDQ12JaIrx4Nm5eQ "Configure security tool for GitLab which is not supported in the base system.") topic.

For Harness pipelines, you can configure Checkmarx scans only through the generic Docker Container Image. For more information, see [Implement custom actions for pipelines using Docker image](https://www.servicenow.com/docs/lyDd5Y1L9yyAuDzJFwe0tg "Use the ServiceNow custom actions to collect data related to change request creation, Sonar scan, artifact registration, and package registration in your pipeline with the help of the generic Docker Container Image.").
1. Navigate to the step in your pipeline and add the custom action.

   |-|-|
   | Azure DevOps | 1. Navigate to your pipeline .yml file. 2. In the Tasks section on the right side, search for the ServiceNow DevOps Security Results extension task. 3. Enter the ServiceNow endpoint. 4. Enter the Security results attributes as the following. * Checkmarx SAST - task: ServiceNow-DevOps-Build-Security-Results@1 inputs: connectedServiceName: "" # ServiceNow DevOps Change Velocity Service Connection securityResultAttributes: | {"scanner": "Checkmarx SAST",  "projectId": "", "securityToolId": ""} # scanner: Scanning tool and is required e.g. Checkmarx SAST. # projectId: Id of your Checkmarx SAST project and is required. This attribute is applicable only for Checkmarx SAST. # securityToolId: Security tool onboarded in ServiceNow (sys_id of the onboarded security tool) and is optional. * Checkmarx One - task: ServiceNow-DevOps-Build-Security-Results@1 inputs: connectedServiceName: "" # ServiceNow DevOps Change Velocity Service Connection securityResultAttributes: | {"scanner": "Checkmarx One", "projectName": "", "projectId": "", "scanId": "", "securityToolId": ""} # scanner: Scanning tool and is required e.g. Checkmarx One. # projectName: Name of your Checkmarx One project and is required. This attribute is applicable only for Checkmarx One. # projectId: Id of your Checkmarx One project and can be used instead of projectName field. This attribute is applicable only for Checkmarx One. # scanId: Checkmarx One scan id and is optional. This attribute is applicable only for Checkmarx One. # securityToolId: Security tool onboarded in ServiceNow (sys_id of the onboarded security tool) and is optional. {#configure-checkmarx-scans-on-your-pipeline__ul_s2h_pzz_xyb} 5. Select Add to add the custom action code to your pipeline. {#configure-checkmarx-scans-on-your-pipeline__ol_lrx_bxl_1yb} |
   | Jenkins | 1. Navigate to the Pipeline Syntax from a configured pipeline. 2. Select the snDevOpsSecurityResult step from the Sample Step list, and update the values for the security scan attributes in the step. 3. Select Generate Pipeline Script to create a snippet. You can copy and paste the snippet into the pipeline. * Checkmarx SAST snDevOpsSecurityResult securityResultAttributes: '{"scanner": "Checkmarx SAST", "projectId": "", "securityToolId": ""}' // scanner: Scanning tool and is required e.g. Checkmarx SAST. // projectId: Id of your Checkmarx SAST project and is required. This attribute is applicable only for Checkmarx SAST. // securityToolId: Security tool onboarded in ServiceNow (sys_id of the onboarded security tool) and is optional. * Checkmarx One snDevOpsSecurityResult securityResultAttributes: '{"scanner": "Checkmarx One", "projectName": "", "projectId": "", "scanId": "", "securityToolId": ""}' // scanner: Scanning tool and is required e.g. Checkmarx One. // projectName/projectId: Name/Id of your Checkmarx One project and is required. This attribute is applicable only for Checkmarx One. // scanId: Checkmarx One scan id and is optional. This attribute is applicable only for Checkmarx One. // securityToolId: Security tool onboarded in ServiceNow (sys_id of the onboarded security tool) and is optional. {#configure-checkmarx-scans-on-your-pipeline__ul_d3g_jzz_xyb} {#configure-checkmarx-scans-on-your-pipeline__ol_kcw_mxl_1yb} |
   | GitHub Actions | 1. Navigate to your workflow .yml file. 2. In the Marketplace section on the right side, search for the ServiceNow DevOps Security Results custom action. 3. Add the following snippet into your .yml file. * Checkmarx SAST ServiceNowSecurityScanResults: # jobs that must complete successfully before this job will run needs: build # type of machine to run the job on runs-on: ubuntu-latest name: ServiceNow Security Scan Results steps: - name: ServiceNow DevOps Security Results uses: ServiceNow/servicenow-devops-security-result@v3.0.0 with: # Devops Integration User Name devops-integration-user-name: ${{ secrets.SN_DEVOPS_USER }} # Devops Integration User Password devops-integration-user-password: ${{ secrets.SN_DEVOPS_PASSWORD }} # ServiceNow Instance URL instance-url: ${{ secrets.SN_INSTANCE_URL }} # Orchestration Tool Id tool-id: ${{ secrets.SN_ORCHESTRATION_TOOL_ID }} # GitHub Context context-github: ${{ toJSON(github) }} # Display Name of the Job job-name: 'ServiceNow Security Scan Results' security-result-attributes: '{"scanner": "Checkmarx SAST", "projectId": "", "securityToolId": ""}' # scanner: Scanning tool and is required e.g. Checkmarx SAST. # projectId: Id of your Checkmarx SAST project and is required. This attribute is applicable only for Checkmarx SAST. # securityToolId: Security tool onboarded in ServiceNow (sys_id of the onboarded security tool) and is optional. * Checkmarx One ServiceNowSecurityScanResults: # jobs that must complete successfully before this job will run needs: build # type of machine to run the job on runs-on: ubuntu-latest name: ServiceNow Security Scan Results steps: - name: ServiceNow DevOps Security Results uses: ServiceNow/servicenow-devops-security-result@v3.0.0 with: # Devops Integration User Name devops-integration-user-name: ${{ secrets.SN_DEVOPS_USER }} # Devops Integration User Password devops-integration-user-password: ${{ secrets.SN_DEVOPS_PASSWORD }} # ServiceNow Instance URL instance-url: ${{ secrets.SN_INSTANCE_URL }} # Orchestration Tool Id tool-id: ${{ secrets.SN_ORCHESTRATION_TOOL_ID }} # GitHub Context context-github: ${{ toJSON(github) }} # Display Name of the Job job-name: 'ServiceNow Security Scan Results' security-result-attributes: '{"scanner": "Checkmarx One", "projectName": "", "projectId": "", "scanId": "", "securityToolId": ""}' # scanner: Scanning tool and is required e.g. Checkmarx One. # projectName/projectId: Name/Id of your Checkmarx One project and is required. This attribute is applicable only for Checkmarx One. # scanId: Checkmarx One scan id and is optional. This attribute is applicable only for Checkmarx One. # securityToolId: Security tool onboarded in ServiceNow (sys_id of the onboarded security tool) and is optional. {#configure-checkmarx-scans-on-your-pipeline__ul_twk_nyz_xyb} {#configure-checkmarx-scans-on-your-pipeline__ol_qhn_ynn_dyb}For more information, see [GitHub marketplace](https://github.com/ServiceNow/servicenow-devops-security-result). |
   | Harness | Run the generic Docker Container Image to use the following script. For more information, see [Implement custom actions for pipelines using Docker image](https://www.servicenow.com/docs/lyDd5Y1L9yyAuDzJFwe0tg "Use the ServiceNow custom actions to collect data related to change request creation, Sonar scan, artifact registration, and package registration in your pipeline with the help of the generic Docker Container Image."). - stage: name: ServiceNow DevOps Security Result identifier: Security description: "" type: Custom spec: execution: steps: - stepGroup: name: Security identifier: Security steps: - step: type: Run name: ServiceNow DevOps Security Result identifier: ServiceNow_DevOps_Security_Result spec: connectorRef: docker_hub_connector_for_harness image: servicenowdocker/sndevops:5.0.0 shell: Sh command: |- sndevopscli create securityScan -p "{"pipelineInfo":{ "buildNumber":"<+stage.nodeExecutionId>", "taskExecutionUrl":"<+pipeline.executionUrl>?stage=<+stage.nodeExecutionId>", "orchestrationPipeline":"<+org.identifier>/<+project.identifier>/<+pipeline.name>" }, "securityResultAttributes":{ "scanner":"Veracode", "applicationName":"", "buildVersion":"", "securityToolId":"" } }" envVariables: SNOW_URL: <+variable.SNOW_URL> SNOW_TOOLID: <+variable.SNOW_TOOLID> SNOW_TOKEN: <+variable.SNOW_TOKEN> stepGroupInfra: type: KubernetesDirect spec: connectorRef: kubernates_connector namespace: harness-delegate-ng tags: {} |
   [ ]

   {#configure-checkmarx-scans-on-your-pipeline__choicetable_mt3_1xl_1yb}
2. Run the pipeline to retrieve the security scan results.
{#configure-checkmarx-scans-on-your-pipeline__ol_pvj_bfm_cyb}