GRC & DevSecOps

SARIF and CEF exports for DevSecOps and SIEM

Surface scanners that only show a letter grade do not fit enterprise workflows. Every shared Noetfield Shield report includes SARIF 2.1.0 and CEF exports with severity, rule IDs, CWE references, and deep links back to the live finding.

GET /v1/reports/{id}/sarif after any URL scan, agent scan, or org assessment with share: true.
GET /v1/reports/{id}/cef for Splunk, Microsoft Sentinel, Google Chronicle, and other CEF collectors.
Compatible with GitHub code scanning upload actions and Azure DevOps SARIF ingestion.
Pair with executive brief markdown at /brief.md for board-ready narrative.
Framework tags include OWASP Top 10, SOC 2 CC, and CIS v8 on the underlying JSON report.

Run a scan with share API reference

Complete on platform — SARIF for GHAS

Scan with share. POST /v1/scan or URL Scan tab with consent and share:true in the API body.
Save report id. Response includes report_id and exports.sarif URL.
Download SARIF. GET /v1/reports/{id}/sarif — SARIF 2.1.0 with CWE on every finding.
Upload to GitHub. Use workflow below or github/codeql-action/upload-sarif@v3.
Board narrative. GET /v1/reports/{id}/brief.md for executive summary (not a certification).
SIEM path. GET /v1/reports/{id}/cef when Splunk or Sentinel needs CEF instead of SARIF.

Org assessment and deploy hooks also emit SARIF when share:true — same export paths.

GitHub Actions — SARIF upload

- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: shield.sarif
    category: noetfield-shield

Full workflow: scan with share: true, download exports.sarif, then upload. See repo path sites/noetfield-scan/integrations/github-actions/shield-sarif-upload.yml.

From scan to merged PR gate

Run a URL scan after deploy, persist the report ID, fetch SARIF, and upload to your repository security tab. Security champions see the same finding taxonomy whether the issue came from a header misconfiguration or an exposed Supabase surface. No separate export tooling or manual CSV conversion.