sarif-parsing

You can parse SARIF 2.1.0 static analysis results to identify security vulnerabilities by processing the file with command-line utilities or Python environments to extract and interpret findings. This skill handles aggregation, deduplication, and severity-based filtering.

Yes, you can aggregate and deduplicate security findings from multiple code scanning runs. The skill uses stable fingerprinting to identify and suppress duplicate alerts across different scan runs, combining them into a unified report.

The best way to filter high-severity vulnerabilities from SARIF files for CI/CD integration is using severity-based filtering to automatically fail builds or generate actionable summaries for developers based on the parsed static analysis results.

You need either standard command-line utilities like jq or Python environments with libraries such as pysarif, sarif-tools, ijson, and jsonschema to execute the parsing logic and generate actionable reports from SARIF static analysis scan results.

Processing large SARIF files often results in duplicate security alerts because multiple static analysis scan runs can identify the same vulnerability. This skill uses stable fingerprinting to detect and suppress these duplicates during aggregation.

A limitation when aggregating static analysis findings from different scanners is ensuring format compliance with SARIF 2.1.0. The skill requires standard command-line utilities or Python environments to properly parse, deduplicate, and filter the combined results.