--- title: Checkmarx Open Source Analysis (OSA) Connector Guide slug: rbvm-help/checkmarx-open-source-analysis-osa-connector-guide createdAt: 2026-10-26T13:51:22.253Z --- **Summary**: How to set up and use the Checkmarx Open Source Analysis (OSA) connector in Ivanti Neurons. ## Overview Checkmarx Open Source Analysis (OSA) is a software composition analysis solution that detects and identifies the open source components within an application and provides detailed risk metrics regarding open source vulnerabilities, potential license conflicts, and outdated libraries. The Ivanti Neurons platform provides an API-based connector that integrates with Checkmarx OSA, enabling the customers to bring in their open source findings. It allows the customers to gain visibility into their overall risk due to vulnerabilities in their source code and enable a simpler, more efficient way to manage those vulnerabilities. ## Supported Versions Ivanti Neurons supports the following versions of Checkmarx OSA: - **Version 9.0.0 and above.** ## User Prerequisites/Checkmarx OSA Setup Checkmarx OSA is deployed as an on-premises solution. For Ivanti Neurons to communicate and pull data the following access is required: 1. A user account with, at minimum, read access to scan results and vulnerabilities associated with it. The user should also have API access. 2. RiskSense On-Site Application (ROSA) OVA setup. [More information on ROSA is available here](docId:7wHkLoxSH3F00T9lvOuYv). ## Checkmarx OSA Connector API Calls The following API calls are performed during a connector run to pull security vulnerabilities from Checkmarx into Ivanti Neurons. | **API Type** | **Endpoint** | | ---------------------------------------- | ---------------------------------------------- | | Authentication | cxrestapi/auth/identity/connect/token | | List Projects | cxrestapi/projects | | List latest scan for each project | cxrestapi/osa/scans?projectId=\ | | Fetch vulnerabilities from each scan | cxrestapi/osa/vulnerabilities?scanId=\ | | Fetch license risks from each scan | cxrestapi/osa/licenses?scanId=\ | | Fetch associated libraries for each scan | cxrestapi/osa/libraries?scanId=\ | ## Configuring Checkmarx OSA Connector in Ivanti Neurons Navigate to the **Automate > Integrations** page. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/N6T9UnB5FOanUDKWj7uEe_palo-alto-xpanse-expander.png" alt="Navigation - Automation - Integrations" position="flex-start" size="33" width="229" height="151" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" showCaption="false"} Using the search bar in the upper-right corner of the **Integrations** page, type **CxOSA** to find the connector. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/uUho0VluxJDA3z26eOtWr_checkmarx-open-source-analysis.png" alt="Checkmarx OSA Connector - Search for Connector" position="flex-start" size="97" width="679" height="205" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Checkmarx Open Source Analysis.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Checkmarx Open Source Analysis.png" showCaption="false"} Locate the **Checkmarx OSA** card on the page and click **Configuration**. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/QxeXnfFlgrnu3bm3rWeeK_checkmarx-open-source-analysis1.png" alt="Checkmarx OSA Connector - Configuration Button Location" position="flex-start" size="53" width="373" height="473" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Checkmarx Open Source Analysis_1.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Checkmarx Open Source Analysis_1.png" showCaption="false"} In the new window under **Connection**, complete the required fields, as described below. - **Name**: The connector’s name. - **URL**: The URL to access the Checkmarx OSA instance. Enter the domain name along with the port (if any). - For instance, if the login URL for your Checkmarx instance is https\://\/CxWebClient/Login.aspx, then the URL for the connector should be just the domain name with port (if applicable): https\://\/ - **Username**: Username used to access the connected system. - **Password**: Password for the user. - **SSL**: Optional SSL of the instance in base64 format. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/-Vhi62HNmlWqH3SyxW1Cw_checkmarx-open-source-analysis2.png" alt="Checkmarx OSA Connector - Connector Configuration" position="flex-start" size="68" width="478" height="500" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Checkmarx Open Source Analysis_2.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Checkmarx Open Source Analysis_2.png" showCaption="false"} Click **Test Credentials** to verify the credentials are correct and have access to make API calls to the Checkmarx OSA system. Configure the desired schedule for the connector to retrieve results from the Checkmarx OSA instance and optionally turn on **Enable auto URBA (Update Remediation by Assessment)**. User may specify the oldest scan data pull from the following options: 30 days, 60 days, 90 days, 6 months, or 1 year. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/NSYLZCbweBQvlGKcjxgHX_checkmarx-open-source-analysis3.png" alt="Checkmarx OSA Connector - Complete Connector Configuration" position="flex-start" size="71" width="496" height="444" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Checkmarx Open Source Analysis_3.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Checkmarx Open Source Analysis_3.png" showCaption="false"} Click the **Save** button to save the connector’s configuration and create the connector. Once saved, the connector is now visible on the **Integrations** page under **Currently Configured Integrations**. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/9YYGMCppbNn-7LT1KZRiw_checkmarx-open-source-analysis4.png" alt="Checkmarx OSA Connector - Configured Checkmarx Connector" position="flex-start" size="31" width="220" height="253" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Checkmarx Open Source Analysis_4.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Checkmarx Open Source Analysis_4.png" showCaption="false"} Clicking the **History** button displays the connector details for each pull. The **Sync** button allows users to perform an on-demand sync. The **Edit** button allows the user to edit the connector configuration. The **Delete** button allows the user to delete the connector. Once files have been processed on the Uploads page, the user can view the ingested data by navigating to the **Applications** and **Application Findings** pages. ## Mapping Checkmarx OSA fields in Ivanti Neurons This table depicts the high-level mapping of CheckmarxOSA fields in Ivanti Neurons. | **Ivanti Neurons Fields** | **Checkmarx Fields** | | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Scanner Severity | Severity name in case of Security Risk.
RiskLevel in case of License Risk. | | Normalized Severity | Score in case of Security Risk
RiskLevel in case of License Risk.
All these values are converted into scale of 0-10, Please contact Ivanti Neurons support for more details. | | Scanner Plugin | SimilarityId | | Application Name | ProjectName | | Plugin Source Status | State | | License Risk (section) | It covers all the license information such as name, copyrightRiskScore, patentRiskScore, copyLeft, linking, royalityFree, url | ### Ivanti Neurons Tags The following fields from Checkmarx OSA are converted into Ivanti Neurons tags. These tags are used for searching, playbook automation, and for better visualization in Dashboards. - Outdated Libraries :::hint{type="info"} **Note**: The tag name is prefixed with the field name to make searches easier. ::: ### Common Fields in Ivanti Neurons Here are the default values for the following Ivanti Neurons fields as defined for Checkmarx OSA: - **Scanner Name**: CheckmarxOSA - **Finding Type**: OSS - **Risk Type**: Either Security or License, depending on the data type.