schema

Semgrep Schema

graph LR
    SemgrepDeployment -- RESOURCE --> SemgrepFindingAssistant
    SemgrepDeployment -- RESOURCE --> SemgrepGoLibrary
    SemgrepDeployment -- RESOURCE --> SemgrepNpmLibrary
    SemgrepDeployment -- RESOURCE --> SemgrepSASTFinding
    SemgrepDeployment -- RESOURCE --> SemgrepSCAFinding
    SemgrepDeployment -- RESOURCE --> SemgrepSCALocation
    SemgrepDeployment -- RESOURCE --> SemgrepSecretsFinding
    SemgrepSASTFinding -- HAS_ASSISTANT --> SemgrepFindingAssistant
    SemgrepSCAFinding -- HAS_ASSISTANT --> SemgrepFindingAssistant
    SemgrepSCAFinding -- USAGE_AT --> SemgrepSCALocation

SemgrepDeployment

A Semgrep Cloud deployment containing an organization's security resources.

Properties

Field Index Description
id Yes Unique integer identifier for the deployment.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
name Yes Name of the security organization connected to the deployment.
slug Yes Lowercase deployment identifier used to query the Semgrep API.

Relationships

  • (:SemgrepDeployment)-[:RESOURCE]->(:SemgrepFindingAssistant): Connects a Semgrep deployment to Assistant data generated for its findings.

  • (:SemgrepDeployment)-[:RESOURCE]->(:SemgrepGoLibrary): Connects a Semgrep deployment to one of its dependencies.

  • (:SemgrepDeployment)-[:RESOURCE]->(:SemgrepNpmLibrary): Connects a Semgrep deployment to one of its dependencies.

  • (:SemgrepDeployment)-[:RESOURCE]->(:SemgrepSASTFinding): Connects a Semgrep deployment to one of its SAST findings.

  • (:SemgrepDeployment)-[:RESOURCE]->(:SemgrepSCAFinding): Connects a Semgrep deployment to one of its SCA findings.

  • (:SemgrepDeployment)-[:RESOURCE]->(:SemgrepSCALocation): Connects a Semgrep deployment to one of its SCA usage locations.

  • (:SemgrepDeployment)-[:RESOURCE]->(:SemgrepSecretsFinding): Connects a Semgrep deployment to one of its secret findings.

SemgrepFindingAssistant

AI-generated triage, remediation, and explanation data for a finding.

Properties

Field Index Description
id Yes Identifier shared with the parent finding.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
autofix_fix_code AI-generated source code fix for the finding.
autotriage_reason Reasoning supporting the AI triage verdict.
autotriage_verdict AI recommendation to fix or ignore the finding.
component_risk AI-assessed risk level of the affected component.
component_tag AI-generated tag describing the matched code's purpose.
guidance_instructions Step-by-step remediation instructions.
guidance_summary Short summary explaining how to remediate the finding.
rule_explanation Detailed explanation of the rule and its security impact.
rule_explanation_summary Concise explanation of why the rule flagged the code.

Relationships

  • (:SemgrepDeployment)-[:RESOURCE]->(:SemgrepFindingAssistant): Connects a Semgrep deployment to Assistant data generated for its findings.

  • (:SemgrepSASTFinding)-[:HAS_ASSISTANT]->(:SemgrepFindingAssistant): Links a cloud SAST finding to its Semgrep Assistant analysis.

  • (:SemgrepSCAFinding)-[:HAS_ASSISTANT]->(:SemgrepFindingAssistant): Links an SCA finding to its Semgrep Assistant analysis.

SemgrepGoLibrary

A Go library dependency reported by Semgrep.

Additional Labels: This node also uses Dependency, GoLibrary, SemgrepDependency.

Additional Label Definitions:

  • Dependency: A node participating in the shared Dependency graph interface.
  • GoLibrary: Compatibility label for the deprecated GoLibrary semgrep node label. Use SemgrepGoLibrary instead. Scheduled for removal in v1.0.0.
  • SemgrepDependency: A semgrep node participating in the shared SemgrepDependency graph interface.

Ontology Projection: SemgrepGoLibrary contributes data to canonical PackageVersion nodes.

Properties

Field Index Description
id Yes Unique identifier formed from the dependency name and version.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
ecosystem Package ecosystem reported by Semgrep.
name Dependency name.
normalized_id Yes Cross-tool package identifier used to create a canonical PackageVersion node.
type Canonical package type derived from the ecosystem.
version Dependency version.

Relationships

  • (:GitHubRepository)-[:REQUIRES]->(:SemgrepGoLibrary): Links a GitHub repository to a dependency it requires.

    • Properties:

      Field Description
      specifier Version specifier required by the repository.
      transitivity Whether the dependency is direct or transitive.
      url URL of the manifest location declaring the dependency.

  • (:GitLabProject)-[:REQUIRES]->(:SemgrepGoLibrary): Links a GitLab project to a dependency it requires.

    • Properties:

      Field Description
      specifier Version specifier required by the repository.
      transitivity Whether the dependency is direct or transitive.
      url URL of the manifest location declaring the dependency.

  • (:PackageVersion)-[:DETECTED_AS]->(:SemgrepDependency): A canonical package version was detected as a Semgrep dependency.

  • (:SemgrepDeployment)-[:RESOURCE]->(:SemgrepGoLibrary): Connects a Semgrep deployment to one of its dependencies.

SemgrepNpmLibrary

An npm library dependency reported by Semgrep.

Additional Labels: This node also uses Dependency, NpmLibrary, SemgrepDependency.

Additional Label Definitions:

  • Dependency: A node participating in the shared Dependency graph interface.
  • NpmLibrary: Compatibility label for the deprecated NpmLibrary semgrep node label. Use SemgrepNpmLibrary instead. Scheduled for removal in v1.0.0.
  • SemgrepDependency: A semgrep node participating in the shared SemgrepDependency graph interface.

Ontology Projection: SemgrepNpmLibrary contributes data to canonical PackageVersion nodes.

Properties

Field Index Description
id Yes Unique identifier formed from the dependency name and version.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
ecosystem Package ecosystem reported by Semgrep.
name Dependency name.
normalized_id Yes Cross-tool package identifier used to create a canonical PackageVersion node.
type Canonical package type derived from the ecosystem.
version Dependency version.

Relationships

  • (:GitHubRepository)-[:REQUIRES]->(:SemgrepNpmLibrary): Links a GitHub repository to a dependency it requires.

    • Properties:

      Field Description
      specifier Version specifier required by the repository.
      transitivity Whether the dependency is direct or transitive.
      url URL of the manifest location declaring the dependency.

  • (:GitLabProject)-[:REQUIRES]->(:SemgrepNpmLibrary): Links a GitLab project to a dependency it requires.

    • Properties:

      Field Description
      specifier Version specifier required by the repository.
      transitivity Whether the dependency is direct or transitive.
      url URL of the manifest location declaring the dependency.

  • (:PackageVersion)-[:DETECTED_AS]->(:SemgrepDependency): A canonical package version was detected as a Semgrep dependency.

  • (:SemgrepDeployment)-[:RESOURCE]->(:SemgrepNpmLibrary): Connects a Semgrep deployment to one of its dependencies.

SemgrepSASTFinding

A code-level security issue reported by Semgrep Cloud or Semgrep OSS.

Ontology Mapping: This node uses the ontology label SecurityIssue.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Unique finding identifier from Semgrep Cloud or synthesized for an OSS finding.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
branch Repository branch where the finding was discovered.
categories Categories associated with the finding.
confidence Confidence assigned to the finding.
cwe_names CWE identifiers associated with the rule.
description Description of the vulnerability from the rule message.
end_col Column where the finding ends.
end_line Line where the finding ends.
file_path Yes Path of the file where the finding was discovered.
fix_status Cloud finding fix status based on triage.
line_of_code_url URL of the affected line of code. Available for cloud findings.
opened_at UTC date and time when the cloud finding was opened.
owasp_names OWASP category names associated with the rule.
repository Yes Repository path where the finding was discovered.
repository_url Full URL of the repository where the finding was discovered.
risk_severity Property generated by analysis job: Semgrep SAST findings risk analysis based on severity and repository archive status..
rule_id Yes Identifier of the rule that triggered the finding.
severity Severity assigned to the finding.
start_col Column where the finding starts.
start_line Line where the finding starts.
state Current cloud finding state.
title Yes Short title for the finding.
triage_status Cloud finding triage status.
_ont_first_seen Yes Normalized field sourced from opened_at.
_ont_severity Yes Normalized field sourced from severity.
_ont_source Module that populated this node's ontology fields.
_ont_status Yes Normalized field sourced from state.
_ont_title Yes Normalized field sourced from title.

Relationships

  • (:SemgrepDeployment)-[:RESOURCE]->(:SemgrepSASTFinding): Connects a Semgrep deployment to one of its SAST findings.

  • (:SemgrepSASTFinding)-[:FOUND_IN]->(:GitHubRepository): Links a SAST finding to the GitHub repository containing the affected code.

  • (:SemgrepSASTFinding)-[:FOUND_IN]->(:GitLabProject): Links a SAST finding to the GitLab project containing the affected code.

  • (:SemgrepSASTFinding)-[:HAS_ASSISTANT]->(:SemgrepFindingAssistant): Links a cloud SAST finding to its Semgrep Assistant analysis.

SemgrepSCAFinding

A dependency vulnerability discovered by Semgrep Supply Chain.

Conditional Labels:

  • CVE (ontology label) when has_cve equals true. A cross-provider CVE resource in Cartography's ontology.
  • SecurityIssue (ontology label) when has_cve equals false. A cross-provider SecurityIssue resource in Cartography's ontology.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Unique identifier for the finding from the Semgrep API.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
branch Repository branch where the finding was discovered.
confidence Confidence assigned by Semgrep.
cve_id Yes CVE identifier associated with the vulnerability.
dependency Affected dependency name and version.
dependency_file Yes Path of the dependency manifest containing the vulnerable package.
dependency_file_url Yes URL of the dependency manifest containing the vulnerable package.
dependency_fix Closest dependency version that fixes the vulnerability.
description Description of the dependency vulnerability.
fix_status Fix status based on finding triage.
ghsa_id Yes GHSA advisory identifier when the finding is not CVE-backed.
has_cve Whether cve_id contains a valid CVE identifier.
package_manager Package ecosystem of the affected dependency.
reachability Whether the vulnerable dependency is reachable.
reachability_check Semgrep's determination of whether reachability was confirmed.
reachability_condition Condition under which the vulnerable code is reachable.
reachability_risk Property generated by analysis job: Semgrep SCA findings reachability risk analysis based on likelihood and impact. Impact = Severity, Likelihood = reachability + reachability_check.
ref_urls Reference URLs associated with the finding.
repository Yes Repository path where the finding was discovered.
repository_url Full URL of the repository where the finding was discovered.
rule_id Yes Identifier of the rule that triggered the finding.
scan_time UTC date and time when the finding was discovered.
severity Severity assigned by Semgrep.
summary Yes Short title summarizing the finding.
transitivity Whether the affected dependency is direct or transitive.
triage_status Current triage status of the finding.
_ont_base_severity Yes Normalized field sourced from severity.
_ont_cve_id Yes Normalized field sourced from cve_id.
_ont_description Normalized field sourced from description.
_ont_first_seen Yes Normalized field sourced from scan_time.
_ont_references Normalized field sourced from ref_urls.
_ont_severity Yes Normalized field sourced from severity.
_ont_source Module that populated this node's ontology fields.
_ont_status Yes Normalized field sourced from triage_status.
_ont_title Yes Normalized field sourced from summary.

Relationships

  • (:CVE)-[:LINKED_TO]->(:SemgrepSCAFinding): Links a CVE to the Semgrep SCA finding that identified it.

  • (:SemgrepDeployment)-[:RESOURCE]->(:SemgrepSCAFinding): Connects a Semgrep deployment to one of its SCA findings.

  • (:SemgrepSCAFinding)-[:AFFECTS]->(:Dependency): Links an SCA finding to the affected dependency observation.

  • (:SemgrepSCAFinding)-[:AFFECTS]->(:PackageVersion): generated by analysis job Ontology - SemgrepSCAFinding AFFECTS PackageVersion linking.

  • (:SemgrepSCAFinding)-[:FOUND_IN]->(:GitHubRepository): Links an SCA finding to the GitHub repository containing the dependency.

  • (:SemgrepSCAFinding)-[:FOUND_IN]->(:GitLabProject): Links an SCA finding to the GitLab project containing the dependency.

  • (:SemgrepSCAFinding)-[:HAS_ASSISTANT]->(:SemgrepFindingAssistant): Links an SCA finding to its Semgrep Assistant analysis.

  • (:SemgrepSCAFinding)-[:USAGE_AT]->(:SemgrepSCALocation): Links an SCA finding to a source location where the dependency is used.

SemgrepSCALocation

A source location where vulnerable dependency code is used.

Properties

Field Index Description
id Yes Unique identifier for the vulnerable dependency usage location.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
end_col Column where the usage ends.
end_line Line where the usage ends.
path Yes Path of the file containing the vulnerable dependency usage.
start_col Column where the usage starts.
start_line Line where the usage starts.
url URL of the file containing the usage.

Relationships

  • (:SemgrepDeployment)-[:RESOURCE]->(:SemgrepSCALocation): Connects a Semgrep deployment to one of its SCA usage locations.

  • (:SemgrepSCAFinding)-[:USAGE_AT]->(:SemgrepSCALocation): Links an SCA finding to a source location where the dependency is used.

SemgrepSecretsFinding

A hardcoded secret discovered by Semgrep in source code.

Ontology Mapping: This node uses the ontology label SecurityIssue.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Unique identifier for the finding from the Semgrep API.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp of the last sync that observed this node.
confidence Confidence assigned to the finding.
created_at UTC date and time when the finding was created.
finding_path Yes File path and line number where the secret was discovered.
finding_path_url URL of the exact location where the secret was discovered.
mode Semgrep mode under which the secret was detected.
ref Branch or ref where the secret was discovered.
ref_url URL of the branch or ref containing the secret.
repository_name Yes Repository path where the secret was discovered.
repository_scm_type Source control system hosting the repository.
repository_url Full URL of the repository where the secret was discovered.
repository_visibility Visibility of the repository.
rule_hash_id Yes Hash identifier of the rule that triggered the finding.
severity Yes Severity assigned to the finding.
status Yes Current status of the finding.
type Yes Type of secret detected.
updated_at UTC date and time when the finding was last updated.
validation_state Yes Result of validating whether the secret is active.
_ont_first_seen Yes Normalized field sourced from created_at.
_ont_severity Yes Normalized field sourced from severity.
_ont_source Module that populated this node's ontology fields.
_ont_status Yes Normalized field sourced from status.
_ont_title Yes Normalized field sourced from type.
_ont_type Yes Normalized field sourced from type.

Relationships

  • (:SemgrepDeployment)-[:RESOURCE]->(:SemgrepSecretsFinding): Connects a Semgrep deployment to one of its secret findings.

  • (:SemgrepSecretsFinding)-[:FOUND_IN]->(:GitHubRepository): Links a secret finding to the GitHub repository containing the secret.

  • (:SemgrepSecretsFinding)-[:FOUND_IN]->(:GitLabProject): Links a secret finding to the GitLab project containing the secret.

On this page
Semgrep SchemaSemgrepDeploymentSemgrepFindingAssistantSemgrepGoLibrarySemgrepNpmLibrarySemgrepSASTFindingSemgrepSCAFindingSemgrepSCALocationSemgrepSecretsFinding