Skip to main content

SonarQube

Visualize Sonarqube projects and users, map Sonarqube users to employees, and monitor user changes through queries and alerts.

Installation​

The SonarQube integration ingests projects, users, user groups, and code findings using the SonarQube REST API. Before configuring the integration in JupiterOne, create a SonarQube API token for a user with the required permissions.

Prerequisites​

The API token must belong to a user with the Administer System global permission. This permission allows the integration to enumerate all projects, users, and user groups across your SonarQube instance. See Managing permissions in the SonarQube documentation for details on setting global permissions.

Creating an API token in SonarQube​

  1. Log in to SonarQube as a user with the Administer System permission.
  2. Click your avatar in the top-right corner and select My Account.
  3. Go to the Security tab.
  4. Under Tokens, enter a descriptive name (for example, JupiterOne) and click Generate.
  5. Copy the generated token — it is shown only once.

See Managing your tokens for further guidance.

note

If connecting to SonarQube from JupiterOne-hosted infrastructure, the SonarQube instance must be reachable at a public URL (for example, https://sonarqube.example.com).

Configuration in JupiterOne​

To install the SonarQube integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select SonarQube. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the SonarQube account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • Base Url: The URL of your SonarQube instance (for example, https://sonarqube.example.com).

  • API Token: The token generated in the previous step.

Click Create once all values are provided to finalize the integration.

Data Volume Configuration​

The following optional settings control the scope and volume of findings data ingested. Narrowing these filters reduces the number of entities created in JupiterOne.

Ingestion Windows​

FieldDescriptionDefaultOptions
Findings Ingestion WindowLimits findings ingestion to those created within the specified number of days.9090, 180, 275, 365

Data Filtering Options​

FieldDescriptionDefaultOptions
Findings SeveritiesLimits findings ingestion to the selected severity levels. Values in parentheses apply to SonarQube 10.4 and later.MAJOR (MEDIUM), CRITICAL (HIGH), BLOCKER (HIGH)INFO (LOW), MINOR (LOW), MAJOR (MEDIUM), CRITICAL (HIGH), BLOCKER (HIGH)
Findings StatusesLimits findings ingestion to the selected issue statuses. Values in parentheses apply to SonarQube 10.4 and later.All statuses enabledOPEN, CONFIRMED, REOPENED (FALSE_POSITIVE), RESOLVED (ACCEPTED), CLOSED (FIXED)
Findings TypesLimits findings ingestion to the selected finding types. Values in parentheses apply to SonarQube 10.4 and later.VULNERABILITY (SECURITY)CODE_SMELL (MAINTAINABILITY), BUG (RELIABILITY), VULNERABILITY (SECURITY)

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.