audit-augmentation

You can overlay SARIF static analysis findings by matching them to code graph nodes via normalized file paths and overlapping line ranges. This builds severity- and tool-specific subgraphs, like sarif:error or sarif:semgrep, to contextualize security issues.

Yes, weAudit findings and notes can be imported and converted into Trailmark annotations. The process creates separate subgraphs for findings versus notes, and organizes them by severity tiers like weaudit:high for prioritized triage.

Cross-referencing is done by correlating overlaid SARIF and weAudit findings with pre-analysis reachability subgraphs. This maps blast radius, taint, and privilege boundary data to the findings, enabling prioritization of the most actionable issues.

Yes, running engine.preanalysis() is required before augmentation. This pre-analysis generates the reachability signals and base code graph structure needed to successfully match and overlay external audit findings.

The best way to prioritize security findings is querying severity-based subgraphs together, such as sarif:error and weaudit:high. This cross-references tool outputs with code structure and pre-analysis context to highlight the most critical issues.

Matching works by normalizing file paths from the SARIF file and comparing them against code graph nodes, then checking for overlapping line ranges. This ensures static-analysis findings are accurately mapped to the correct locations in the code structure.