CodeQL integration
Prioritize CodeQL alerts by adding exploit context to static analysis findings.
Integration details
Primary category
Static Application Security Testing
Sync direction
CodeQL ↔ Konvu
Findings are ingested from CodeQL into Konvu. Based on your workflow, Konvu can then push context, status changes, and severity updates back to CodeQL.
Status
Available
What is CodeQL?
CodeQL is GitHub's semantic code analysis engine that discovers vulnerabilities across codebases by treating code as data and running queries against it. It powers GitHub Advanced Security's code scanning alerts.
Why connect CodeQL to Konvu
- Focus on CodeQL alerts that represent exploitable vulnerabilities in your deployed code, not theoretical findings.
- Reduce triage time by layering exploitability analysis on top of CodeQL's rich data-flow and control-flow results.
- Sync triage decisions back to GitHub code scanning alerts to keep remediation workflows in one place.
How it works
Scan
CodeQL produces findings from scans or assessments.
Ingest & enrich
Konvu ingests those findings and enriches them with code, configuration, and deployment context.
Assess exploitability
Konvu determines exploitability and recommended action with evidence attached.
Sync decisions
Based on your workflow, Konvu can push context, status updates, and severity adjustments back into CodeQL.
Quick setup
Configure CodeQL from the integrations list in Konvu.
- 1Go to /configuration/integrations in Konvu and choose CodeQL.
- 2Authorize access and confirm the data sources you want to sync.
- 3Save the configuration to start syncing.
Sync direction
CodeQL ↔ Konvu
Findings are ingested from CodeQL into Konvu. Based on your workflow, Konvu can then push context, status changes, and severity updates back to CodeQL.
More integrations
View all
Checkmarx
Focus Checkmarx SAST and SCA alerts on code paths with demonstrated exploit potential.
GitHub
Prioritize GitHub CodeQL and Dependabot alerts by adding exploit context to each finding.
GitLab
Add exploitability analysis to GitLab's built-in SAST and SCA pipeline findings.
OpenText Fortify
Add exploitability analysis to Fortify findings and prioritize based on environment-specific conditions.
Semgrep
Triage Semgrep's rule-based code findings and supply chain alerts with exploit evidence.
Snyk
Triage Snyk vulnerabilities across code, dependencies, and containers with exploit context.