# Sonatype for Fortify SSC

**Note**

Get the [Sonatype Lifecycle integration with SSC](https://marketplace.opentext.com/cybersecurity/content/sonatype-for-fortify-ssc) on the Fortify Marketplace.

## Release Notes

### nexus-iq-fortify

## Changelog

### Version 6.0.0 (June 26, 2026)
- Upgraded the Fortify integration to use Spring Boot 4.1 and Java 17
- Java 17 is now the minimum supported runtime version

### Version 5.4.2 (March 31, 2026)
- Added support for fetching projects using pagination from Fortify SSC

### Version 5.4.1 (January 12, 2026)
- Fixed an issue where expired waivers caused synchronization to fail
- Fixed an issue where auto-waivers caused synchronization to fail

### Version 5.4.0 (October 28, 2025)
- Added a new endpoint for ad‑hoc synchronization by scanId

### Version 5.3.0 (March 03, 2025)
- Converted the `iqWebhook` endpoint to an asynchronous model to improve stability

### Version 5.2.1 (February 11, 2025)
- Prevented redundant artifact uploads when no missed reports were found in the history

### Version 5.2.0 (February 06, 2025)
- Fixed a bug that caused redundant artifacts
- Added support for Golden Versions, the non-breaking upgrade resolving policy violations for the component and its dependencies

### Version 5.1.3 (January 23, 2025)
- Fixed an issue where an older report was uploaded to Fortify SSC. The sync service now correctly prioritizes and only uploads the latest available report
- Added the Sonatype Policy Name to the violation detail view
- The IQ Fortify SSC Integration is compatible with Fortify SSC 24.4.2

### Version 5.1.2 (November 14, 2024)
- Fixed an issue where the expected scan report was not being synchronized if the most recent one was an identical report generated by continuous monitoring

### Version 5.1.1 (October 07, 2024)
- Fixed issue where sync service did not terminate as expected when the `killProcess` flag was set to `true`
- Added support for `fortifyApplicationId` when using the `startScanLoad` endpoint

### Version 5.1.0 (September 11, 2024)
- Fortify Application ID can now be used to map JSON instead of the application name
- Added support for synchronizing all violation categories, not only security
- Uploads of reports generated by continuous monitoring will be skipped if the data is identical to the previously uploaded report
- Fortify Audit Details are now clickable links for Fortify versions 23.0 and later
- Included license information for the report in the synchronized artifact. This can be configured via the `include.license.information` property

### Version 5.0.1 (May 22, 2024)
- Resolved issue that sometimes caused a Null Pointer Exception during synchronization of violations for custom policies

### Version 5.0.0 (Apr 22, 2024)
- Consolidated artifact and suppression upload into a single call

### Version 4.3.1 (Feb 22, 2024)
- Memory usage optimizations

### Version 4.3.0 (Oct 27, 2023)
- Memory usage optimizations

### Version 4.2.13 (Aug 22, 2023)
- Added a new endpoint for triggering synchronization for a given project on-demand

### Version 4.2.12 (Jun 26, 2023)
- CVSS scores when only Sonatype CVSS Score Exists fixed

### Version 4.2.11 (Jun 20, 2023)
- CVSS scores being printed in wrong fields bug fixed
- Enhanced Logging

### Version 4.2.10 (May 24, 2023)
- Bug fix related to fetching most recent report from the IQ Server
- Overall performance improvements

### Version 4.2.9 (May 2, 2023)
- Bug fix for fetching all issues from Fortify SSC

### Version 4.2.8 (Mar 6, 2023)
- Addition of configuration flag `loadfile.cache` which can be set to `false` to prevent IQ reports from being cached

### Version 4.2.7 (Feb 13, 2023)
- Performance Improvements: mapping files are now processed in parallel and the process is now up to 10x faster

### Version 4.2.6 (Nov 29, 2022)
- Handled null pointer exceptions caused by potentially null fields found while scanning composer format components

### Version 4.2.5 (Oct 12, 2022)
- Allow blanks and special characters in names of Fortify applications mappings

### Version 4.2.4 (Oct 7, 2022)
- Updating artifacts upload logic to upload when:
  - An external policy evaluation is triggered e.g. via IQ CLI, CI pipelines
  - Continuous monitoring identifies a new policy violation

### Version 4.2.3 (Sep 26, 2022)
- Reduced log verbosity of non-fatal errors

### Version 4.2.2 (Aug 12, 2022)
- The IQ Fortify SSC Integration works with a large number of applications (bug fix)
- The IQ Fortify SSC Integration is compatible with Fortify SSC 22.1.2

### Version 4.2.0 (Apr 7, 2022)
- Skip upload to SSC for reports generated by Continuous Monitoring (unless changes are detected)
- Improved logs to make them less verbose and easier to read
- Added support to read login credentials from environment variables
- Added support for synchronization with IQ Webhooks
- Updated Spring boot from version 2.5.6 to 2.6.6 in response to CVE-2022-22965

### Version 4.1.0 (Feb 24, 2022)
- Updated Sonatype rulepack to include OWASP top 10 2021 vulnerabilities
- Restored `logfile.location` and loglevel properties
- Restored `killServer` property
- Removed `forceUpload` - artifact update is now handled internally
- SSC artifacts will always be updated with every sync, even when no changes have been detected in scan results
- Deprecation notice: forceUpload flag is deprecated and has no impact in the process

### Version 4.0.2 (Dec 20, 2021)
- Updated to the latest log4j version for security purposes

### Version 4.0.1 (Dec 17, 2021)
- Architectural improvements
- Performance improvements
- Support for project ids of type long

## Compatibility

Administrator roles for IQ Server and Fortify SSC are required to access all functionality.

| Plugin Version | IQ Server Version | Fortify Software Security Center Version | Java Runtime |
| --- | --- | --- | --- |
| 6.0.0 and higher | 126 and higher | 24.2 and higher | JDK 17 |
| 1.0 to 5.4.2 | 126 and higher | 19.10 to 25.4 | JDK 8 to JDK 17 |

## Architecture Overview

|     |
| --- |
|  |

The integration has two main parts. Both of them are included in the installation bundle

- IQ - Fortify parser plugin
- IQ - Fortify integration service

## IQ - Fortify Parser Plugin Installation

1. Go to your SSC installation and click on _ADMINISTRATION_
2. Then go to _Plugins > Parsers_
3. Click on _NEW_

4. You will find the following warning. Click on _OK_

5. In the next screen select _BROWSE_ and select the plugin JAR file

6. By default, SSC disables any newly loaded plugin. Click on the Sonatype plugin and enable it.

7. Finally, click on _OK_ to close the warning.

The Sonatype parser plugin should be installed and enabled.

## IQ - Fortify Integration Service Configuration and Execution

Both servers must be up and running in order to successfully export data from Lifecycle to Fortify SSC. Other versions of the servers may work, but they are not officially supported.

### Service configuration

The integration services have multiple configurations used to access Lifecycle and Fortify SSC servers and fine-tune their behavior.

For this purpose, we have a file named **iqapplication.properties**. Those configurations are described in detail in this section. Also, you can find useful comments in the configuration file itself.

**Note**

Fields can also be provided via environmental variables. To convert a property name in the canonical form to an environment variable name:

- Replace dots (.) with underscores (_)
- Remove any dashes (-)
- Convert to uppercase

| Parameter | Description and notes | Example |
| --- | --- | --- |
| `iqserver.url` | _Required_<br>Base URL where your IQ Server instance is running. | [http://127.0.0.1:8070](http://127.0.0.1:8070/) |
| `iqserver.username` | _Required_<br>IQ Server username. | admin |
| `iqserver.password` | _Required_<br>IQ Server password. | admin123 |
| `sscserver.url` | _Required_<br>Base URL where your Fortify SSC instance is running. | [http://127.0.0.1:8080/ssc](http://127.0.0.1:8080/ssc) |
| `sscserver.token` | _Required_<br>[CIToken](https://www.microfocus.com/documentation/fortify-software-security-center/2010/SSC_Help_20.1.0/Content/SSC_UG/Gen_Auth_Tokens.htm) generated by SSC for an Administrator User. | ODA0NWYzMTUtMzNmOS00ZDY<br>2LTlkODYtY2RlMDA5YWU1ODQ5 |
| `server.port` | _Required_<br>Port where the integration service will be listening for requests. | 8182 |
| `loadfile.location`<br>Default: .work | _Optional_<br>The directory will be generated in the working directory. | /home/sonatype/work |
| `priority.critical`<br>Default: 8 | _Optional_<br>Minimum threat level for being considered critical. | 8 |
| `priority.high`<br>Default: 4 | _Optional_<br>Minimum threat level for being considered high. | 4 |
| `priority.medium`<br>Default: 2 | _Optional_<br>Minimum threat level for being considered medium. | 2 |
| `mapping.file`<br>Default: mapping.json | _Optional_<br>Mapping file to be used as input for the batch process. | /etc/mapping.json |
| `iq.report.type`<br>Default: policy | _Optional_<br>Possible values: raw, vulnerabilities, policy | raw|vulnerabilities|policy |
| `synchronisation.mapping.thread.count`<br>Default: 4 | _Optional_<br>Number of mappings being processed in parallel. | 4 |
| `synchronisation.details.thread.count`<br>Default: 32 | _Optional_<br>Number of threads to be used for fetching vulnerability details and remediations for components. | 32 |
| `loadfile.cache`<br>Default: true | _Optional_<br>Whether or not to keep the cached files in the work folder. | false |
| `synchronize.projects.continuously`<br>Default: true | **Since 4.3.0**<br>_Optional_<br>Whether or not to run the synchronization in the background continuously. If set to false, other means of synchronization can be used, such as triggering the full cycle manually, executing on demand synchronizations or using webhooks from the IQ Server. | true |
| `scheduling.fixed.rate.minutes`<br>Default: 1 | **Since 4.3.0**<br>_Optional_<br>Duration between full synchronizations if syncProjectsContinuously is true. If a full synchronization takes longer than the value entered here, it will immediately run again. | 1 |
| `synchronisation.policy.violation.categories`<br>Default: SECURITY, LICENSE, QUALITY, OTHER | **Since 5.1.0**<br>_Optional_<br>Categories to synchronize. |  |
| `include.license.information`<br>Default: true | **Since 5.1.0**<br>_Optional_<br>When true, a file named `effective-licenses.json` will be included in the artifact uploaded to Fortify SSC. | true |
| `killProcess`<br>Default: false | **Since 5.1.1**<br>_Optional_<br>Exits the service after a full sync. Supported only for continuous synchronization and when `startScanLoad` is called without any parameters. | true|false |
| `webhook.process.thread.count`<br>Default: 8 | **Since 5.3.0**<br>_Optional_<br>Number of threads to be used to process Webhook requests. | 12 |
| `overwrite`<br>Default: false | _Optional_<br>Unsuppress issues in SSC that do not have a waiver associated.<br>**Deprecated in version 5.0.0** | true|false |
| `scheduling.waiver.suppression.delay`<br>Default: 30 | _Optional_<br>Time in seconds to run the issue suppression/unsuppression job.<br>**Deprecated in version 5.0.0**<br>Starting in version 4.3.0, waivers will be retried in increments, up to 5 minutes. The value set for this property will not guarantee suppression being tried every 30 seconds. Every individual synchronization will now wait in increments of 30 seconds, 1 minute, 2 minutes, 4 minutes and then afterwards 5 minutes until retry count is exhausted. This configuration still is relevant for how often the tasks are checked to see if they should be retried. | # Run every hour<br>3600 |
| `scheduling.waiver.suppression.retries`<br>Default: 72 | _Optional_<br>Maximum retries before the job discard unprocessed artifacts.<br>**Deprecated in version 5.0.0** | 72 |
| `scheduling.job.cron`<br>Default: 0 0/360 6 * * ? | _Optional_<br>By default, this job will run at 6 AM and then every 6 hours.<br>**Deprecated in version 4.3.0**<br>Starting in version 4.3.0, scheduling job will run continuously. The time to wait between every cycle can be configured by the property `scheduling.fixed.rate.minutes`. | # Run every three hours<br>scheduling.job.cron=0 0 0/3 1/1 * ? |

The integration will synchronize all violation categories by default. However, you can customize it using `iqapplication.properties` to configure which categories will be synchronized. The field and possible values are as follows:

```
synchronisation.policy.violation.categories = SECURITY, LICENSE, QUALITY, OTHER
```

### Running the integration service

- Using a command line, go to the Integration directory. E.g. _/home/sonatype/IntegrationService_
- Start the integration using this command: `./start.sh`
- If you want to run it in the background, you can use: `nohup ./start.sh &`

### Permissions

The CI token owner must have universal access to the following permissions:

- Comment on issues
- Suppress/un-suppress issues
- Upload analysis results
- View application versions

### Synchronization scheduler

**Before 4.3.0**

This service has a built-in scheduler that understands cron-like expressions. By default, it runs every six hours, but that can be configured using the **scheduling.job.cron** property.

**Since 4.3.0**

This service by default synchronizes all entries found in the mapping file with a duration of 1 minute between each run. This behavior can be changed by setting the `synchronize.projects.continuously` property to false or the duration between the cycles can be modified by using the `scheduling.fixed.rate.minutes` property. Modifying the `synchronize.projects.continuously` property has no effect on on-demand synchronization requests.

It is required to configure a _mappings_ file (defined in the **mapping.file** property) to provide the parameters for the projects you want to synchronize in a scheduled fashion.

**Since 5.1.0**

You can enter either the new field `fortifyApplicationId` or keep using `fortifyApplication`.
The mappings file has the following structure:

```
[
  {
    "sonatypeProject": "test-app-01",
    "sonatypeProjectStage": "build",
    "fortifyApplication": "01-test-01",
    "fortifyApplicationVersion": "001",
  },
  {
    "sonatypeProject": "test-app-02",
    "sonatypeProjectStage": "build",
    "fortifyApplicationId": 6,
    "fortifyApplicationVersion": "1.0",
  }
]
```

### Synchronization endpoint

It may happen that you want to synchronize an IQ project that is not already present in your mappings file, or you simply want to trigger a synchronization on demand. For those cases, the integration exposes an endpoint to manually trigger these synchronizations. This is the endpoint definition:

**Endpoint** GET /startScanLoad

| Parameter | Mandatory | Description |
| --- | --- | --- |
| sonatypeProject | yes | Public ID of the project that already exists in IQ Server |
| sonatypeProjectStage | yes | Project stage in IQ Server |
| fortifyApplication | either this or `fortifyApplicationId` | Target application name in Fortify SSC |
| fortifyApplicationId | either this or `fortifyApplication` | Target application ID in Fortify SSC |
| fortifyApplicationVersion | yes | Target application version in Fortify SSC |
| overwrite | no | Unsuppressed issues in SSC that do not have a waiver associated. If this value is not present we take the value from the properties file |
| saveMapping | no | Take the current request and save it as a mapping. The mapping will be saved only if the synchronization is executed successfully |

**Note**

If one of the mandatory parameters is missing in the request, the integration will perform synchronization using all the values found in the mappings file (like in the scheduled job).
In this specific case, even if the `saveMapping` is true, the request won't be saved since we do not have a full mapping to save.

### One-time Project Synchronization endpoint

To synchronize a desired project ad-hoc, use this endpoint. It will synchronize the provided project in all stages immediately. The mapping information for the provided project must exist in the mappings file.

**Endpoint** GET /startScanLoadSingleProject?sonatypeProject={sonatypeProjectPublicId}

| Parameter | Mandatory | Description |
| --- | --- | --- |
| sonatypeProject | yes | Public ID of the project that already exists in IQ Server |

### One-time Report Synchronization Endpoint by `scanId`

**Since 5.4.0**

Use this endpoint to synchronize a single IQ report into Fortify SSC by its `scanId`.

#### Endpoint

```
GET /startScanLoadSingleReport?scanId={scanId}
```

#### Prerequisites

- A mapping file must exist (the file configured by `mapping.file`) and it must contain exactly one mapping.
- The mapping must include the following properties:

```
[
    {
      "sonatypeProject": "test-app",
      "fortifyApplication": "test-app",
      "fortifyApplicationVersion": "1.0"
    }
]
```

#### Behavior

Invoking the endpoint synchronizes the report identified by the provided `scanId` into the Fortify application/version specified in the single mapping shown above (e.g., `test-app` / `1.0`).

#### Recommended Configuration

Set these properties when you’re using the ad‑hoc `scanId` flow:

```
synchronize.projects.continuously=false
killProcess=true
loadfile.cache=false
```

- Set `synchronize.projects.continuously=false` so the background scheduler does not try to run the usual mapping-file sync while you’re doing a one-off report sync via `scanId`. This only disables the continuous schedule; it does not affect on-demand endpoints.
- Set `killProcess=true` since there’s no point keeping the service running after this one-time operation completes.
- Set `loadfile.cache=false` to avoid keeping temporary cached artifacts for this one-off run.

## Integrating IQ Webhook with Fortify SSC Sync Service

Refer to [Integration of IQ Webhook with Fortify SSC Sync Service](https://help.sonatype.com/en/integration-of-iq-webhook-with-fortify-ssc-sync-service.html "Integration of IQ Webhook with Fortify SSC Sync Service") for details.

## About the Scan Report

### Waiver Comment

If you encounter a waiver comment: "Related policy waiver not found. Please re-evaluate", it means you had a waived issue in your IQ server and the waiver was removed.

To get rid of this comment, you can go to your IQ instance, reevaluate the report, and run another synchronization.

|     |
| --- |
|  |

**Since 5.0.0**

This comment now appears in the "Comments & History" section.

|     |
| --- |
|  |

### Remediation information

**Since 5.1.0**

The remediation information is now displayed in a separate field for better visibility.

### Continuous Monitoring

Reports generated by Continuous Monitoring in IQ Server are skipped if they don't reveal any new information compared to the most recently synchronized report.