Integrations · Security tools
CertiField consumes your scanners. It does not replace them.
You already own the tools that find the problems. What is missing is the layer that decides which control each finding bears on, what the finding means for the authorization, and whether a judgment your team already made still holds.
- Vulnerability scanners
- CycloneDX SBOM
- Dependency-Check
- DISA STIG catalog
- Dependency-Track
- Ref
- I-31
- Kind
- Scanners
- Normalized
- one finding definition
One definition of "a finding", across every source.
Findings arrive from ACAS and Nessus, from SAST and DAST, from container and dependency scanners, each with its own idea of what constitutes one issue. CertiField normalizes them onto a single definition so the number on a dashboard, the number in a list and the number in an export are the same number.
That sounds obvious until you have watched a project report one count on a trend line and a different count in the list directly above it. Counting per advisory rather than per occurrence is the choice that matters, because the advisory is what gets fixed.
- Ref
- I-32
- Kind
- SBOM
- Formats
- CycloneDX · Dependency-Check
- Suppressions
- survive re-upload
A false-positive decision should survive the next upload.
SBOM findings are recreated by every upload. If a false-positive judgment lives on the finding row, it dies with the row and the next build silently re-imports the same finding unflagged — so the decision has to be made again, or worse, quietly is not.
CertiField stores the suppression as a decision keyed on the project, the vulnerability and the component: the three things that survive an upload. It applies backwards over uploads that already happened, requires a justification to set, and is deliberately distinct from "mitigated" — mitigated claims work was done, false-positive claims there was never a vulnerability, and both numbers reach an authorization package.
- CycloneDX and Dependency-Check, with format detection winning over a mislabeled upload
- Suppressions keyed to survive the next build
- Justification required to suppress
- Optional Dependency-Track for programs already running it
- Ref
- I-33
- Kind
- STIGs
- Source
- DISA catalog
- Offline
- air-gap bundle
DISA STIG catalog, ranked against what you actually run.
Sync the catalog, and CertiField ranks applicability against the system's imported inventory and the technologies your team recorded by hand. Updates merge into existing per-project checklists rather than replacing them, so a re-sync does not throw away the work already done on a checklist.
Sync is administrator-triggered, not a timer nobody remembers configuring. For disconnected environments, catalog bundles export and import by hand and carry AI-derived relevance profiles with them, so an enclave running with AI switched off still gets applicability ranking of the same quality.
- Ref
- I-34
- Kind
- Uploads
- Validated
- magic bytes, not extension
- Scanned
- fail-closed
Every file goes through the same door.
Scan results, SBOMs, checklists, evidence, diagrams, policy documents, POA&M templates and inventory all route through one upload pipeline. The declared file type is treated as a claim to be verified, not an instruction about which parser to use — the parser is chosen from the verified result.
Content is validated against magic bytes and a minimal extension list scoped to that specific surface, then malware-scanned. If the scanner is configured and unreachable, uploads are rejected rather than waved through, and the health endpoint says so out loud instead of failing quietly.
Next step