SARIF (Static Analysis Results Interchange Format) is an open industry standard developed by OASIS to achieve a consistent view of static analysis results in JSON format, regardless of which tool produced the findings. Instead of dealing with different proprietary exports across platforms, SARIF provides a universal language for security and quality findings, enabling true interoperability across your entire DevSecOps toolchain.
With SARIF exports, your Kiuwan results flow directly into GitHub, Azure DevOps, Jira, and other platforms—no custom integration needed. One format, endless compatibility.
Common uses:
These exports follow the official SARIF 2.1 specification and include all required fields. This is the official specification maintained by OASIS.
Yes, SARIF exports are available through the Kiuwan REST API, enabling seamless integration into CI/CD pipelines and automated reporting workflows.
SARIF and SBOM (Software Bill of Materials) are complementary standards that provide a complete picture of application security. While SBOM catalogs what components are in your software (dependencies, libraries, versions), SARIF reports what vulnerabilities and defects exist in that code.
Together, they enable comprehensive risk assessment: SBOM identifies vulnerable components, while SARIF provides detailed analysis findings. Many organizations export both formats from Kiuwan to create unified security dashboards that map vulnerabilities to specific components.
SARIF is widely supported across the DevSecOps ecosystem, including GitHub Advanced Security, Azure DevOps, GitLab, Jenkins, and many security orchestration platforms.
