Skip to main content

Semgrep

Visualize Semgrep deployments, projects, code findings, secrets, and supply chain vulnerabilities. Map code security findings to projects and repositories, and monitor application security issues through queries and alerts.

Installation​

Semgrep is a static application security testing (SAST) tool that helps you find bugs and enforce code standards. The JupiterOne integration ingests findings, repositories, and rule data from your Semgrep account.

info

You will need a Semgrep API Token with the Web API scope to set up this integration. This requires a Team or Enterprise tier account.

Configuration in Semgrep​

To create an API token for JupiterOne:

  1. Log in to your Semgrep web application at https://semgrep.dev.
  2. Navigate to Settings > Tokens (Admin access required).
  3. Create a new API token or edit an existing one.
  4. Under Token scopes, ensure Web API is enabled.
    • Tokens with only the Agent (CI) scope cannot access the Web API endpoints required by this integration.
  5. Copy the API token for use in JupiterOne configuration.

Required API Access:

The integration uses the following Semgrep API endpoints and requires read access to:

  • Deployments (/api/v1/deployments)
  • Projects (/api/v1/deployments/{slug}/projects)
  • Findings (/api/v1/deployments/{slug}/findings)
  • Secrets (/api/v1/deployments/{id}/secrets)
  • Supply Chain Vulnerabilities (/api/v1/deployments/{id}/ssc-vulns)

See Semgrep's API documentation for more information about token scopes.

Configuration in JupiterOne​

To install the Semgrep integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Semgrep. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the Semgrep account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • Your Semgrep API Token that was generated in the Semgrep web app.

Click Create once all values are provided to finalize the integration.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.