Skip to content

Import SARIF results from another tool

SARIF (Static Analysis Results Interchange Format) is an open format for sharing static-analysis results between tools. If another tool finds the issues but you'd rather navigate and fix them in Understand, import its SARIF export.

Understand reads and writes SARIF 2.1.0, so any tool that emits a conforming 2.1.0 log can feed results in — there's no per-tool integration to enable, and nothing to configure on the producing side beyond asking it for SARIF output.

Import

Drag the .sarif file onto the Understand main window. When prompted "Do you want to sync the file?", click Sync. The issues load and appear in the Violation Browser (Checks → Browse Violations) and on the right-hand margin of the editor, just like native CodeCheck violations. (Choosing Edit instead just opens the file as text.)

Imported violations are marked: select one and the Information Browser shows an Origin field naming the SARIF file it came from (hover for the full path), plus the Severity the producing tool assigned. See View & triage violations.

"Sync" means it stays connected

Importing isn't a one-time copy. Sync records the file's path as a synced inspection:

  • It is re-read every time the project opens, so refreshing the results is just a matter of overwriting the .sarif file — no re-import step.
  • The path is stored as a shared project setting, so it travels with the .und project to teammates and CI agents. Use a path everyone can resolve — a relative or named-root path rather than an absolute one on your own machine. The project's portability check flags synced files that live outside the project's mapped roots; see portable project paths.
  • Because Understand doesn't own those violations, they can't be deleted from the Violation Browser. Stop syncing instead (below).

Manage imported results

Imported logs appear alongside native runs in Checks → Open CodeCheck. Hover a row for its actions:

Action Effect
Stop showing results Un-syncs the file: its violations leave the Violation Browser and editor sidebar. The .sarif file itself is untouched.
Show results Re-syncs a file you'd previously stopped showing.
Baseline Uses the imported results as a baseline.

Sync and baseline are mutually exclusive — an imported log is either live in the Violation Browser or serving as a baseline, not both. A row that is currently synced offers only stop showing results; un-sync it first if you want to baseline it or remove it from the list.

That makes the natural workflow for a third-party tool: import last release's log and baseline it, then sync the current log — so the Violation Browser shows only what the other tool newly found.

If the results don't land on your source

SARIF records the paths of the machine that produced them, which are rarely the paths on yours. Understand resolves them two ways:

  • Absolute paths must match the files in your Understand project. Check Project → Files if nothing appears.
  • originalUriBaseIds (SARIF's symbolic path roots) are matched by name against your project's named roots, and the local path wins. So if the producing tool wrote its results against a SRCROOT base ID, define a named root called SRCROOT pointing at your checkout and the results relocate cleanly. Understand also supplies a built-in UND_PROJECT root — the directory holding the .und project. See portable projects for named roots and und roots.

Symbolic roots are the durable fix: they're what make one CI-produced log usable on every developer's machine.

Rules come along with the results

If the log names a CodeCheck configuration Understand already has, that configuration is reused. Otherwise Understand synthesizes one from the log's own rules section — named after the SARIF file — and registers the producing tool's rule IDs and descriptions. So the other tool's rule text is available in the UI, and its results group by configuration like any other run.