Search code examples
sonarqubeazure-pipelinescheckmarx

What is the difference between SonarQube and Checkmarx CxSAST & CxSCA?

I have integrated SonarQube and Checkmarx SAST and SCA into the Azure DevOps build pipeline. I am able to see both the SonarQube and Checkmarx reports without any issues.

I have the following questions. Could someone please clarify:

  1. What is the difference between SonarQube and Checkmarx CxSAST?
  2. What is the common thing between these two?
  3. In which situations are SonarQube and Checkmarx preferred?
Solution

  • If I were to boil it down to a short phrase, SonarQube is used for ensuring code quality, and CheckMarx is used for ensuring the security of a system running that code.

    SonarQube looks at several areas, including the code coverage percentage of unit tests of the code, duplication percentages, and also code quality issues found through static analysis of the code.

    CheckMarx, on the other hand, just analyzes the flow of the code and the inputs and outputs. It looks for situations where inputs that could have been provided by an end user are used directly to control behavior, and other "attack vectors".