Hunter Agent findings

View and work through the findings the SonarQube Hunter Agent raises on SonarQube Cloud.

The SonarQube Hunter Agent runs an AI-powered analysis to find vulnerabilities that require human-like understanding of the code, such as broken access control and business-logic flaws, then raises them as issues you triage like any other.

The Hunter Agent is a product that requires a separate subscription to your SonarQube Cloud Enterprise plan. An organization administrator sets it up before you can use it. See Hunter Agent (administration).

To learn what the agent detects and how it works, see Hunter Agent.

Viewing findings

Each project with the agent enabled has a Hunter Agent page in its navigation. This page gives you a results overview: the total number of findings, a breakdown by vulnerability category (broken access control, business logic, and authentication and session management), and the count at each severity within a category.

Select the issues in one of the findings tiles on the Hunter Agent page to open the project's Issues page filtered to SonarQube Hunter Agent findings. Each category count links to the issues for that category. On the Issues page, you can also filter by the hunter-agent tag to see all agent findings, or by a per-category tag such as hunter-broken-access-control to focus on one category.

Each finding is raised as a vulnerability with a security software quality and an estimated severity, and includes an explanation with Why is this an issue? and How to fix it? sections. You review, assign, comment on, and resolve these findings like any other issue. See Managing code issues to learn how to review issues in SonarQube Cloud.

Related pages

• Hunter Agent (administration)
• AC/DC: Hunter Agent