Veracode Connector Guide

Overview

Veracode helps organizations identify and manage application security risks through SCA (Software Composition Analysis), SAST (Static Application Security Testing), and DAST (Dynamic Application Security Testing). By consolidating results from these methods, Veracode delivers centralized visibility into vulnerabilities, license compliance issues, and code flaws across the development lifecycle.

The Balbix integration automatically ingests Veracode application inventory and findings, normalizes the data, and enriches it with context for accurate prioritization.

Balbix leverages AI to aggregate, normalize, and deduplicate data ingested from across your IT and security ecosystem. This unified view of inventory and exposures enriched with operational and business context, enables deployment gap analysis, risk-based exposure management, and cyber risk quantification. These insights help organizations drive faster, more informed, and more scalable risk reduction.

Integration Summary

Integration Type

Fetch: An inbound API integration that retrieves application security data from Veracode using the Veracode REST APIs (commercial region base URL https://api.veracode.com). The connector authenticates with Veracode API credentials (API ID and Secret) and pulls metadata and findings for consolidation in Balbix.

Types of Assets Fetched

Application profiles from the Veracode portfolio, including associated sandboxes and policy context via the Applications API.

For web apps and APIs scanned dynamically, links between Dynamic Analysis results and application profiles are supported via the Dynamic Analysis linking capability.

Types of Data Fetched

Vulnerability findings across scan types via the Findings API: Static Analysis, Dynamic Analysis, Software Composition Analysis (SCA), and Manual Penetration Testing. Data typically includes CWE, severity, status, mitigation state, and timestamps (created, first observed, last seen, closed).

Third‑party component inventory and SCA findings via the SCA REST API, including component names, versions, advisories, policy status, and SBOM‑related information.

Prerequisites

Follow the procedure documented in https://docs.veracode.com/r/REST_APIs_Quickstart to generate credentials for the Balbix connector.

Field Mappings

Imported Field	Balbix Field	Comments
API: /appsec/v1/applications
`["profile", "name"]`	`application_name`
`["app_profile_url"]`	`application_id`
`["profile", "tags"]`	`application_tags`	`Prefix = "Veracode-Tag: "`
`["profile", "business_unit", "name"]`	`application_tags`	`Prefix = "Veracode-BU: "` `Only added if not Falsy. Excludes values such as None and Not Specified`
`["profile", "business_owners", "email"]`	`app_business_owner`	`Fallback: ["profile", "business_owners", "name"]`
`["profile", "description"]`	`application_description`
`["profile", "git_repo_url"]`	`app_repository`
`["profile", "business_criticality"]`	`application_tags`	`Prefix = "Veracode-Business-Criticality: "`
`["profile", "teams", "team_name"]`	`application_tags`	`Prefix = "Veracode-Team: "`

API: /appsec/v2/applications/{app_guid}/findings?scan_type=SCA
`["scan_type"]`	`app_vuln_assessment_type`
`["description"]`	`app_vuln_description`
`["finding_status", "first_found_date"]`	`app_vuln_foa`
`max(app_vuln_foa, ["finding_status", "last_seen_date"])`	`app_vuln_loa`
`["finding_status", "status"]`	`app_vuln_state`
`["finding_status", "resolution"]`	`app_vuln_details`
`["finding_status", "new"]`	`app_vuln_details`
`["finding_status", "resolution_status"]`	`app_vuln_details`
`["finding_details", "licenses"]`	`app_vuln_details`	`Includes License ID and risk rating`
`["finding_details", "cve", "exploitability", "full_cve"]`	`app_vuln_name`	`Fallback: ["finding_details", "cve", "name"]`
`["finding_details", "cve", "severity"]`	`app_vuln_severity`
`["finding_details", "component_filename"]`	`app_dependency_name`
`["finding_details", "component_path", "path"]`	`app_dependency_path`
`["finding_details", "version"]`	`app_dependency_version`
`["finding_details", "language"]`	`app_vuln_details`
`["finding_details", "metadata", "sca_scan_mode"]`	`app_vuln_details`
`["finding_details", "metadata", "sca_dep_mode"]`	`app_vuln_details`
API: /appsec/v2/applications/{app_guid}/findings?scan_type=STATIC
`["scan_type"]`	`app_vuln_assessment_type`
`["finding_status", "resolution"]`	`app_vuln_details`
`["finding_status", "new"]`	`app_vuln_details`
`["finding_status", "resolution_status"]`	`app_vuln_details`
`["finding_status", "first_found_date"]`	`app_vuln_foa`
`["finding_status", "last_seen_date"]`	`app_vuln_loa`
`["finding_status", "resolution_status"]`	`app_vuln_details`
`["finding_status", "mitigation_review_status"]`	`app_vuln_tags`	`Prefix = "Veracode-Mitigation-Review-Status: "`
`["finding_details", "cwe", "id"]`	`app_vuln_cwe_ids`
`["finding_details", "cwe", "name"]`	`app_vuln_name`
`["finding_details", "module"]`	`app_codebase_module_name`
`["finding_details", "file_path"]`	`app_codebase_file_path`
`["finding_details", "file_line_number"]`	`app_codebase_file_line`
`["finding_details", "file_name"]`	`app_codebase_file_name`
`["finding_details", "finding_category", "name"]`	`app_vuln_details`
`["finding_details", "finding_category", "id"]`	`app_vuln_details`
`["finding_details", "procedure"]`	`app_vuln_details`

Set up your Veracode connector

Follow this procedure to add a Veracode connector:

API Reference Documentation

https://docs.veracode.com/r/REST_APIs_Quickstart