Export Findings as SARIF

This website stores cookies on your computer.These cookies are used to collect information about how you interact with our website and allow us to remember you. We use this information to improve and customize your browsing experience and for analytics and metrics about our visitors both on this website and other media. To find out more about the cookies we use, please review our Privacy Policy.

If you decline, your information won’t be tracked when you visit this website. A single cookie will be used in your browser to remember your preference not to be tracked.
By clicking “Accept All”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts.

SARIF (Static Analysis Results Interchange Format) is the standard way to move security findings between tools. DevOps Shield exports assessment results as SARIF so they flow straight into GitHub Advanced Security, Azure DevOps, and any other SARIF-aware consumer.

Steps

Identify the assessment. List completed runs with dos assessment list and note the assessment ID.
Export to SARIF. Run dos assessment export --format sarif (or call the export operation in the API reference).
Upload to your scanner. Publish the SARIF file to GitHub code scanning or Azure DevOps Advanced Security.
Triage in context. Findings appear alongside your existing alerts, deduplicated by rule and location.

Tip: Exports are idempotent - re-running with the same assessment ID overwrites the prior result set rather than duplicating it.

DevOps Shield

Feed results into your existing security tooling

Export Findings as SARIF

Steps

Related references