> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squasher.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Scanner findings import

> Import SARIF, SBOM, Snyk, and Aikido findings and see which ones run in production.

Code and dependency scanners report many findings. Squasher imports them and checks each one
against your production traces from the last 7 days, so you can fix first what actually runs.

## Formats

| Format | Tools |
| - | - |
| SARIF 2.1.0 | Semgrep, CodeQL, Snyk Code, XBOW, and others |
| CycloneDX JSON (1.4 to 1.6) | Trivy, Syft, and other SBOM tools |
| SPDX 2.x JSON | Packages with a security advisory reference |
| Snyk Open Source (`snyk test --json`) | Snyk |
| Aikido issues export | Aikido |

Send the export as JSON. One import takes at most 1000 findings and 5 MiB; split bigger reports.

```bash theme={null}
squasher findings import --project $SQUASHER_PROJECT_ID semgrep.sarif --service api
squasher findings import --project $SQUASHER_PROJECT_ID sbom.cdx.json --dry-run
```

## The production check

| Finding has | Squasher checks |
| - | - |
| A file (and function) | Spans with matching `code.file.path` (and `code.function.name`), then the `http.route` of their traces. |
| A route (DAST, pentest) | Spans with that `http.route`. |
| A package (dependency CVE) | Whether the package's OpenTelemetry instrumentation scope emitted spans. |

For each route the result shows requests, distinct callers (`client.address`), requests with a 401
or 403 response, and requests with an error.

| `hit_in_prod.status` | Meaning | `reachability` |
| - | - | - |
| `hit` | Production ran the code or served the route. | `reachable` |
| `live` | The package's instrumentation emitted spans. | `reachable` |
| `not_seen` | Your spans have the attributes, but none match. | `unreachable` for code and routes, `unknown` for packages |
| `no_telemetry` | No span has `code.*` attributes (or `http.route` for route findings). | `unknown` |
| `no_location` | The finding names no file, route, or package. | `unknown` |

If your spans do not carry `code.*` attributes, send a `route_table` that maps handler files to
routes. Squasher checks the 50 most severe code locations of each import; the others are
`unknown`.

## Severity and paging

Squasher keeps the scanner's severity. The check only adds `reachability` and a
`reachability_rank` (3: running with auth failures or errors, 2: running, 1: unknown, 0: not seen)
that you can sort by. Imported findings never open an incident or page anyone.

## Imports run again

Each finding is identified by the scanner, the rule, and the file and line (or the package and
version). A result with neither is identified by its route, title, and the scanner's own
evidence: SARIF `fingerprints` or `partialFingerprints`, else the location it names, else its
message. Importing the same report again does not create duplicates. Use `dry_run=true` (or
`--dry-run`) to see the result without storing it.

Related: [Findings API](https://docs.squasher.ai/api-reference/findings.md), [Anomalies and findings](https://docs.squasher.ai/features/anomalies.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.