--- title: SonarCloud Connector Guide slug: rbvm-help/sonarcloud-connector-guide createdAt: 2026-10-26T13:51:23.753Z --- Summary: How to set up and use the SonarCloud connector in RiskSense. ### Overview SonarCloud is a cloud-based code quality and security service. SonarCloud operates as a static code analyzer that discovers security and quality issues in source code by interacting directly with the repositories. RiskSense provides an API-based connector that integrates with SonarCloud, enabling customers to bring their SAST findings. This connector allows customers to gain visibility into their overall risk due to vulnerabilities in their source code and enable a simpler, more efficient way to manage those vulnerabilities. ### User Prerequisites/SonarCloud Setup SonarCloud is a cloud-based solution. RiskSense requires a user account with the following access to communicate with and pull data from SonarCloud. - Read access to scan results and their associated issues. - API access. ### SonarCloud Connector API Calls The following API calls are performed during a connector run to pull security vulnerabilities from SonarCloud into RiskSense. | **API Type** | **Endpoint** | | ---------------------------------------------- | -------------------------------------------------- | | Authentication | https\://sonarcloud.io/api/authentication/validate | | Fetch List of Projects Keys | https\://sonarcloud.io/api/components/search | | Fetch Analysis Date for Each Project | https\://sonarcloud.io/api/components/show | | Fetch the list of Directories for Each Project | https\://sonarcloud.io/api/components/tree | | Fetch the List of Issues for Each Directory | https\://sonarcloud.io/api/issues/search | | Fetch the List of Rules for the Organization | https\://sonarcloud.io/api/rules/search | ### Fetching the SonarCloud User Token First, log in to your SonarCloud instance with the designated user account. Navigate to **My Account > Security**. Enter the token name and click the **Generate **button. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/4m5DkBnVrIGGH8VgH2DJF_sonarcloud-connector-guide.png" alt="SonarCloud Connector - Generate User Token" position="flex-start" size="93" width="653" height="465" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide.png" showCaption="false"} Copy the user token, as it is only displayed once. Use this token for API authentication. ### Steps to Fetch the Organization Key In addition to the user token, the RiskSense connector also needs the SonarCloud Organization Key. This acts as a key indicator for pulling all the associated projects within it. First, navigate to the **My Organizations** menu option. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/ZmdPFGNtpwWJSDjyFtGGa_sonarcloud-connector-guide1.png" alt="SonarCloud Connector - My Organizations Location" position="flex-start" size="79" width="550" height="186" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_1.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_1.png" showCaption="false"} Copy the Organization Key. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/npCvVKVchGNIjM8Mr5HEx_sonarcloud-connector-guide2.png" alt="SonarCloud Connector - Organization Key Location" position="flex-start" size="51" width="355" height="281" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_2.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_2.png" showCaption="false"} ### Configuring the SonarCloud Connector in RiskSense Navigate to the **Automate > Integrations** page. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/N6T9UnB5FOanUDKWj7uEe_palo-alto-xpanse-expander.png" alt="Navigation - Automation - Integrations" position="flex-start" size="33" width="229" height="151" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" showCaption="false"} Using the search bar in the upper-right corner of the **Integrations** page, type **SonarCloud** to find the connector. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/FzDEBU1TvtgkU2FJP6jND_sonarcloud-connector-guide3.png" alt="SonarCloud Connector - Search for Connector" position="flex-start" size="98" width="685" height="189" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_3.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_3.png" showCaption="false"} Locate the **SonarCloud** card on the page and click **Configuration**. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/VIbSiS5I9PAFTa9kqKJSW_sonarcloud-connector-guide4.png" alt="SonarCloud Connector - Configuration Button Location" position="flex-start" size="36" width="253" height="275" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_4.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_4.png" showCaption="false"} In the new window under **Connection**, complete the required fields, as described below. - **Name**: The connector’s name. - **URL**: The URL to access SonarCloud instance (https\://sonarcloud.io). - **User Token**: User Token retrieved from SonarCloud. Refer to the steps in this section to obtain the User Token. - **Organization Key**:  Refer to the steps in this section to obtain the Organization Key. - **SSL**: Optional instance SSL certificate in base64 format. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/eUX1iYx8-o4iZL1rQJ43H_sonarcloud-connector-guide5.png" alt="SonarCloud Connector - Connector Window" position="flex-start" size="59" width="416" height="310" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_5.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_5.png" showCaption="false"} Click the **Test Credentials** button to ensure the credentials are correct and have the necessary access to make SonarCloud API calls. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/HGzMAj0PmqgKYqAulZwW__palo-alto-xpanse-expander4.png" alt="SonarCloud Connector - Test Credentials" position="flex-start" size="28" width="195" height="136" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander_4.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander_4.png" showCaption="false"} Under Schedule, you can configure the desired schedule for the connector to retrieve results from the SonarCloud instance and optionally select the Oldest Scan Data Pull configuration. The Oldest Scan Data Pull dropdown provides users the flexibility to pull the oldest reports from the last 30, 60, 90, 180 days, and 1 year. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/FUOHod0AZxHF3CZW58dCm_sonarcloud-connector-guide6.png" alt="SonarCloud Connector - Connector Schedule" position="flex-start" size="54" width="376" height="399" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_6.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_6.png" showCaption="false"} Under Connector Specific Options, select the required options from the list. Users have the option to ingest the selected SonarCloud findings. RiskSense can ingest more than one finding type. - **Projects**: Clicking the **All Projects** radio button allows the user to pull all projects under the organization. To pull specific projects, click the **Select Projects** radio button. Once selected, RiskSense makes a dynamic call to SonarCloud to fetch all associated projects. Users can select more than one project, as well. - **Ingest Findings: **The user can ingest selected findings from SonarCloud. More than one type of finding can also be ingested at once. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/EbesATQ1ZbvPf5UL2Y75d_sonarcloud-connector-guide7.png" alt="SonarCloud Connector - Connector Specific Options" position="flex-start" size="78" width="545" height="381" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_7.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_7.png" showCaption="false"} Users can optionally turn on **Enable auto URBA (Update Remediation by Assessment)**. On marking the **Create Assets that do not have vulnerabilities** options, RiskSense will create applications with zero findings. This option will be selected by default, and the user can opt to turn it off. Click the **Save** button to save the connector’s configuration and create the connector. Once saved, the connector is now visible on the **Integrations** page under **Currently Configured Integrations**. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/DF7BqUf2pEArsghb8ETqr_sonarcloud-connector-guide8.png" alt="SonarCloud Connector - Connector Card" position="flex-start" size="35" width="242" height="270" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_8.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/SonarCloud Connector Guide_8.png" showCaption="false"} Clicking the **History** button displays the connector details for each pull. The **Sync** button allows users to perform on-demand sync. The **Edit** button allows the user to edit the connector configuration. The **Delete** button allows the user to delete the connector. Once files have been processed on the Uploads page, view the ingested data by navigating to the **Applications** and **Application Findings** pages. ### Mapping SonarCloud fields in RiskSense This table showcases the high-level mapping of SonarCloud fields in RiskSense. | **RiskSense Fields** | **SonarCloud Fields** | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Scanner Severity | rules -> severity | | Normalized Severity | The SonarCloud Severity scale: Blocker, Critical, Major, Minor, and Info.
RiskSense converts this Severity scale into a scale from 0-10 using specific logic. Please contact RiskSense Support for more information. | | Scanner Plugin | rules -> key | | Application Name | ProjectName | | Plugin Source Status | issues -> status | ### RiskSense Tags The following fields from SonarCloud are converted into RiskSense tags. Use these tags for searching, playbook automation, and better visualization in RiskSense Dashboards. - Organization: This tag name is prefixed with the field name to ease the searching process. - SysTags - Tags - Resolution ### Common Fields in RiskSense The following fields in RiskSense are defined for SonarCloud, along with their default values. - The Scanner Name will be **SONARCLOUD**. - The Finding Type will be **SAST**. ### Vulnerability Date Information in RiskSense Within RiskSense, you will notice several dates on the Findings page. When importing SonarCloud data, RiskSense uses the following criteria to populate these date fields. - **Discovered On** is the Issue Created time in SonarCloud. - **Last Found On** is when the Issue Last updated in SonarCloud.