Veracode SAST in Tenable One Open Connector

The following is not supported in Tenable FedRAMP Moderate environments. For more information, see the Tenable FedRAMP Product Offering.

You are leveraging the Tenable One Open Connector to ingest Veracode Static Application Security Testing (SAST) findings into Tenable Exposure Management. Veracode SAST analyzes application source code to identify security flaws, such as injection, insecure data handling, and misconfigurations.

This purpose-built path normalizes your application-layer code risk alongside the rest of your attack surface, so you can prioritize, track remediation, and score exposure consistently.

Prerequisites

Before you begin, make sure you have the following:

Requirement	Details
Tenable Exposure Management access	A user account with the Connector Manager or Administrator role.
Veracode access	Veracode API credentials (API Key ID and API Key Secret) with access to the Applications and Findings APIs.
Export format	A CSV or Excel (.xlsx) file exported from Veracode through the Platform or the REST API. For more information, see Export Your Veracode SAST Findings.
Asset type decision	Use Code Repository. This asset type matches Veracode SAST targets and exposes the code-level finding fields, such as Code File Path and Code Line Number. You cannot change the asset type after you set up the connector.

Export Your Veracode SAST Findings

To bring Veracode SAST findings into Tenable Exposure Management, export your findings from Veracode, and then upload the file or pull it from Amazon S3.

Export Findings from Veracode

To export SAST findings from Veracode:

1. Log in to the Veracode Platform at analysiscenter.veracode.com.

2. Navigate to Applications, and then open the application profile you want to export.

3. Click the Findings tab.

4. Use the Filter options to select Scan Type: Static and Status: Open, so that the export includes only active findings.

5. Click Export to download a CSV file. Alternatively, call the Veracode REST API and save the results as a CSV or Excel file:

   GET /appsec/v2/applications/{guid}/findings?scan_type=STATIC&size=500&page=0

6. Make sure the file includes the application name (profile.name) and the application profile URL (app_profile_url), or the results URL (results_url). Tenable Exposure Management requires these values for the Code Repository asset.

Tip: For ongoing ingestion, you can then configure the Tenable One Open Connector to pull from a cloud storage continuously, which removes the need for manual exports.

Fields Included in a Veracode SAST Export

The following table lists the key Veracode fields used in the mapping.

Veracode Field	API Path	Description
Application Name	profile.name	Name of the application or code project. Primary asset identifier.
Application GUID	guid	Unique identifier for the application.
App Profile URL	app_profile_url	URL to the application profile in Veracode.
Results URL	results_url	URL to the scan results page. Alternative to the application profile URL.
Issue ID	issue_id	Unique identifier for the individual finding.
Finding Category Name	finding_details.finding_category.name	Short title of the vulnerability or flaw category.
Description	description	Detailed explanation of the finding.
Severity	finding_details.severity	Numeric severity on a 0 to 5 scale (5 = Very High).
CWE ID	finding_details.cwe.id	Common Weakness Enumeration (CWE) identifier.
Attack Vector	finding_details.attack_vector	Common Vulnerability Scoring System (CVSS) attack vector string.
Finding Status	finding_status.status	OPEN or CLOSED.
First Found Date	finding_status.first_found_date	Date the finding was first detected.
Last Seen Date	finding_status.last_seen_date	Date the finding was most recently confirmed.
Resolved At	finding_status.resolved_at	Date the finding was resolved or closed.
File Path	finding_details.file_path	Full path to the file within the project.
File Line Number	finding_details.file_line_number	Line number of the finding in the source file.
Module	finding_details.module	Module or component that contains the finding.
Recommendation	recommendation	Veracode remediation guidance for the finding.
Scan Type	scan_type	STATIC, DYNAMIC, or SCA. Filter to your target scan type.
Tags	profile.tags	Application tags, including team name, business unit, and business criticality.
Last Completed Scan Date	last_completed_scan_date	Most recent scan completion date for the application.
Created	created	Date the application profile was created in Veracode.

Tip: For the mapping to work cleanly, keep the application name (profile.name) consistent across exports and matched to how assets appear in your inventory. Include the application profile URL (app_profile_url), because the Code Repository asset requires it.

Add a Connector

To add a new connector:

1. In the left navigation menu, click Connectors.

   The Connectors page appears.

   

2. In the upper-right corner, click Add new connector.

   The Connector Library page appears.

3. In the search box, type the name of the connector (i.e.,Open Connector). Alternatively, locate the connector in the Custom section.

   

4. On the Tenable One Open Connector tile, click Connect.

   The connector configuration options appear.

Configure the Connector

On the Connector Details page, configure the connector to upload your Veracode SAST export or to pull it from a supported cloud storage.

1. (Optional) In the Connector's Name box, type a descriptive name that identifies the source, for example, Veracode SAST – [Program Name].

2. (Optional) In the Description box, type a description that reflects the source data, for example, Static analysis findings from Veracode.

3. From the Asset Type drop-down, select Code Repository.

   Important: You cannot change the asset type after you save the connector. If you scan both code projects and web endpoints in Veracode, create a separate connector for each asset type.

4. In the Data pulling configuration section, select a data source option:

   • Static File Upload: Select this option to manually upload a single CSV, Excel, or ZIP file. This option is recommended for initial setup.

   • Automated Pull from Cloud Storage (S3): Select this option to establish a continuous data pipeline from your cloud storage. This option is recommended for ongoing sync.

Static File Upload

To upload the export file manually:

1. In the Data pulling configuration section, select Static file upload.

2. Click Upload file, and then select the CSV or Excel (.xlsx) file that you exported from Veracode.

3. Wait for the file preview to load.

4. Continue to Set the Data Update Mode and Retention.

Automated Pull from Cloud Storage (S3)

For automated pulls, grant Tenable Exposure Management read access to a supported cloud storage that holds your Veracode export file. You can use one of two authentication methods.

To configure the automated Amazon S3 pull:

1. In the Data pulling configuration section, select Automated Pull from Cloud Storage (S3).

2. In the Authentication method section, select ARN & External ID or Access Key & Secret Key.

   • If you select the ARN & External ID method, complete the following configurations in your Amazon S3 console:

     1. Navigate to IAM > Policies > Create Policy > Visual Editor.

     2. From the Service drop-down, select S3.

     3. From the Actions allowed drop-down, select the following permissions:

        • ListBucket

        • GetObject

     4. In the Resources section:

        1. For ListBucket, add the Amazon Resource Name (ARN) for the bucket: arn:aws:s3:::YOUR_BUCKET_NAME

        2. For GetObject, add the ARN for the objects: arn:aws:s3:::YOUR_BUCKET_NAME/*

     5. Click Next.

     6. On the Review policy page, type a Name, for example, S3ConnectorReadAccess, and a Description for the policy.

     7. Review the Summary.

     8. Click Create Policy.

     9. Navigate to IAM > Roles > Create Role > AWS account.

     10. In the Account ID field, type the following Tenable account identifier:

         012615275169

     11. Select the Require External ID check box.

     12. In the text box, type the value of your external identifier.

         Important: The external identifier must follow the AWS AssumeRole API constraints: a length of 2 to 1224 characters, and only alphanumeric characters (A-Z, a-z, 0-9) and the following characters: = , . @ : / - _. Unsupported characters can cause the AssumeRole call to fail.

     13. Paste this value into the Connector text box.

     14. Make sure the Require MFA check box is cleared.

     15. Click Next: Permissions.

     16. Attach the policy you created, for example, S3ConnectorReadAccess.

     17. Continue through the wizard and review the settings.

     18. Create the role.

     19. Copy the ARN and External ID to a safe location. You need them to configure the connector.

   • If you select the Access Key & Secret Key method, complete the following configurations in your Amazon S3 console:

     1. Log in to the AWS console with the target account credentials.

     2. Navigate to IAM > Users.

     3. Select the IAM user with the appropriate permissions.

     4. Navigate to the Security Credentials tab.

     5. In the Access Keys section, click Create access key.

        The Create access key wizard appears.

     6. In the Use case section, select the Third-party service radio button.

     7. Click Next.

     8. In the Description tag value text box, type a descriptive tag for the key.

     9. Click Create access key.

     10. Copy the Access Key and Secret Key to a safe location. You need them to configure the connector.

3. After you generate the required authentication values, complete the connector configuration in Tenable Exposure Management:

   • For the ARN & External ID method, fill in the External ID, Role ARN, Region, and S3 URI path, for example, s3://bucket-name/folder/.

   • For the Access Key & Secret Key method, fill in the Access Key, Secret Key, Region, and S3 URI path, for example, s3://bucket-name/folder/.

   • (Optional) Fill in the File Pattern, for example, *.csv or veracode_findings_*.csv.

   • Configure a scheduled Veracode API export script to write new exports to the same Amazon S3 bucket path.

Set the Data Update Mode and Retention

To complete the data configuration:

1. In the Asset Retention box, type the number of days after which Tenable Exposure Management removes assets. The default is 460 days.

   Tip: To learn more, see How does Asset Retention work in the Tenable One Open Connector?.

2. In the Data Update Mode section, select Override data (Full Fetch). This mode treats each upload as the complete source of truth.

   Tip: With Override data (Full Fetch), any remediated finding that is absent from the latest export transitions to Fixed in Tenable Exposure Management automatically. To learn more about sync modes, see Manage Data Sources and Update Modes in Tenable One Open Connector.

3. In the Test connectivity section, click Test Connectivity. Tenable Exposure Management validates the credentials and the accessibility of the file path. You must pass this test before you can create the connector.

   Important: If you change the credentials or remap a file, you must test the connectivity again before you can save the connector.

4. In the Connector scheduling section, configure the time and day(s) on which you want connector syncs to occur.

   Tip: For more information, see Connector Scheduling.

5. Click File Preview to view the first 100 rows of the file.

6. Click Next to proceed to asset type selection and field mapping.

Map Veracode SAST Fields to Tenable Exposure Management

After you upload the file, Tenable Exposure Management displays a field mapping screen with a preview of your data. Use the following table as a reference for the recommended mappings.

Recommended Field Mapping

Veracode Field	Veracode API Path	Tenable Exposure Management Field	Required	Notes
Application Name	profile.name	Asset Name	Yes	Primary asset identifier. Keep it consistent across exports.
App Profile URL	app_profile_url	Code Repository URL	Yes	Required by the Code Repository asset. Use results_url as a fallback.
Application GUID	guid	Asset ID	No	Stable unique identifier for deduplication.
Created	created	Asset > Created Date	No	Date the application profile was created in Veracode.
Last Completed Scan Date	last_completed_scan_date	Asset > Last Observed At	No	Most recent scan date.
Tags	profile.tags	Asset > External Tags	No	Includes team name, business unit, and criticality. Multi-value field.
Profile (full object)	profile	Asset > Custom Attributes (Generic Details)	No	Full application profile metadata stored under the asset generic details.
Finding Category Name	finding_details.finding_category.name	Finding Name	Yes	Short title of the vulnerability type.
Severity (numeric x 2)	finding_details.severity * 2	Finding Score	Yes	Approximates a 0 to 10 score. See the severity note below.
Severity label	finding_details.severity	Finding > Severity	No	See Severity Mapping Reference.
Description	description	Finding > Description	No	Full finding description.
CWE ID	finding_details.cwe.id	Finding > CWEs	No	Prefix with CWE- if the export omits it, for example, CWE-89. Multi-value field.
Attack Vector	finding_details.attack_vector	Finding > CVSS3 Base Vector	No	CVSS attack vector string.
Recommendation	recommendation	Finding > Solutions	No	Veracode remediation guidance.
Finding Status	finding_status.status	Finding > State	No	See Status Mapping Reference.
First Found Date	finding_status.first_found_date	Finding > First Seen (Observed)	No	Date the finding was first detected.
Last Seen Date	finding_status.last_seen_date	Finding > Last Seen (Observed)	No	Date the finding was most recently confirmed.
Resolved At	finding_status.resolved_at	Finding > Last Fixed At	No	Date the finding was closed in Veracode.
File Path	finding_details.file_path	Finding > Code File Path	No	Path to the vulnerable file in the repository.
File Line Number	finding_details.file_line_number	Finding > Code Line Number	No	Line number of the vulnerability.
Module (Package Name)	finding_details.module	Finding > Custom Attributes (Generic Details)	No	Module or component that contains the finding. Stored under the finding generic details.
Scan Type	scan_type	Finding > Type	No	Identifies the analysis type (STATIC).
Finding Category Href	finding_details.finding_category.href	Finding > Origin Finding URL	No	Link back to the Veracode finding category definition.
Issue ID	issue_id	Finding > Custom Attributes (Generic Details)	No	Unique finding identifier for cross-referencing back to Veracode.
Procedure	finding_details.procedure	Finding > Custom Attributes (Generic Details)	No	Affected function name. Stored under the finding generic details.
Relative Location	finding_details.relative_location	Finding > Custom Attributes (Generic Details)	No	Location relative to the module root. Stored under the finding generic details.

Severity Mapping Reference

Veracode reports severity on a 0 to 5 scale. Tenable Exposure Management maps the Veracode severity to its own severity levels as follows.

Veracode Severity (numeric)	Veracode Label	Tenable Exposure Management Severity
5	Very High	Critical
4	High	High
3	Medium	Medium
2	Low	Low
1	Very Low	Informational
0	Informational	Informational

Note: Veracode SAST reports severity on a 0 to 5 scale and does not expose a native 0 to 10 score. To align with the Tenable Exposure Management 0 to 10 scale, multiply the Veracode severity by 2 and map the result to Finding Score.

Status Mapping Reference

Veracode Finding Status	Tenable Exposure Management State	Notes
OPEN	Active/Vulnerable	Active, unresolved finding.
CLOSED	Fixed	Finding remediated or no longer detected.

Deduplication and Aggregation Settings

In the deduplication section, set the unique identifier to the field mapped to Asset Name (profile.name). This setting tells Tenable Exposure Management how to match incoming Veracode applications against existing Code Repository assets instead of creating duplicate records.

If your program uses the application GUID (guid) as a more stable identifier, map it to the asset unique identifier and deduplicate on that field instead.

Tip: To learn about the expected behavior and logic rules for how Tenable Exposure Management maps source file columns, see Tenable One Open Connector Mapping .

Review and Save

To review and save the connector:

1. Review the field mapping preview to confirm that the data parses correctly.

2. Spot-check two or three rows to verify that the application name resolves to a recognizable asset name, and that the Code Repository URL field is populated.

3. Confirm that the Finding CWEs field is populating. This field is important for the Tenable Exposure Management risk scoring.

4. Click Save & Sync.

   Tenable Exposure Management begins processing the file. Depending on the file size, ingestion can take a few minutes. The connector appears in the Connectors list with a Connecting status during initial ingestion.

Validate the Data in Tenable Exposure Management

After the sync completes, confirm that Tenable Exposure Management ingested your Veracode SAST data correctly.

To validate the data:

1. In Tenable Exposure Management, navigate to the Assets page, and search for one of the application names from your Veracode export.

2. Confirm that the asset appears under the Code Repository asset type and that findings are attached to it.

3. Navigate to the Findings page, and filter by the connector name to view all imported findings.

   

4. Open a finding, and verify that the code-level fields (Code File Path and Code Line Number) are populated.

5. Verify that the severity levels, CWE identifiers, and finding names match your expectations.

Common Discrepancies to Expect

• New asset created: If the application name in Veracode does not match an existing Code Repository asset in Tenable Exposure Management, the connector creates a new asset. Normalize application naming before you export.

• Code Repository URL missing: The Code Repository asset requires this field. If your export does not include app_profile_url, use results_url as a fallback.

• Score approximation: Veracode SAST does not expose a native 0 to 10 score. The connector approximates one by multiplying the 0 to 5 severity value by 2. Validate this against your Veracode data if your export includes an actual score.

• Scan type mixing: If your export includes more than one scan type, filter to a single scan type before you upload, or create a separate connector for each type to keep attribution clean.

Keep Your Data Current

Choose the method that fits your operational needs.

Method	Cadence	How
Manual re-upload	As needed	Export from the Veracode Platform or API again, and re-upload the file through the connector.
Cloud storage automation	Scheduled	Tenable Exposure Management pulls the file on your sync schedule.

Note: Export open findings only from Veracode before you upload, and select Override data (Full Fetch) as your sync mode. Any finding that is absent from the latest export (remediated in Veracode) transitions to Fixed in Tenable Exposure Management automatically. This approach keeps your code exposure posture accurate without manual cleanup.

Related topics: