External analyzer reports

This page lists analysis parameters related to the import of issues raised by external, third-party analyzers.

If your analyzer isn’t on this page, see Generic formatted reports for a generic way to import external issues. You can also import SARIF reports.

SonarQube Server doesn’t run your external analyzers or generate reports. It only imports pre-generated reports. Below you’ll find language- and tool-specific analysis parameters for importing reports generated by external analyzers.

We recommend checking out the guides category of the SonarSource community forum, where you might find instructions on generating these reports.

Importing reports from third-party tools

List of properties

Unless otherwise specified, the following properties accept both absolute paths and paths relative to the project root.

Language	Property	Remarks
Ansible	sonar.ansible.ansible-lint.reportPaths	Comma-delimited list of paths to ansible-lint reports in SARIF format (use --sarif-file ansible-lint option).
Apex	sonar.apex.pmd.reportPaths	Comma-delimited list of paths to PMD Apex. Make sure the path in the PMD report matches the path used by analysis. Note: The format of PMD reports generated by sfdx-scanner does not seem to perfectly match the format used by PMD. An alternative is to export to SARIF format instead of PMD.
Cloudformation	sonar.cloudformation.cfn-lint.reportPaths	Comma-delimited list of paths to AWS CloudFormation Linter reports in JSON format
C/C++/Objective-C	sonar.cfamily.valgrind.reportsPaths	Comma-delimited list of paths to Valgrind Memcheck and Helgrind XML reports
CSS	sonar.css.stylelint.reportPaths	Comma-delimited list of paths to StyleLint.io reports
Docker	sonar.docker.hadolint.reportPaths	Comma-delimited list of paths to Hadolint reports in JSON and `sonarqube` format
Go	sonar.go.govet.reportPaths	Comma-delimited list of paths to GoVet reports
Go	sonar.go.golint.reportPaths	Comma-delimited list of paths to GoLint reports
Go	sonar.go.gometalinter.reportPaths	Comma-delimited list of paths to GoMetaLinter reports
Go	sonar.go.golangci-lint.reportPaths	Comma-delimited list of paths to golangci-lint reports in checkstyle format (use --out-format checkstyle golangci-lint option). Depending on how many issues you’re importing, you might want to disable the max-issues-per-linter option in your golangci config file.
Go	sonar.externalIssuesReportPaths	Comma-delimited list of paths to gosec reports in SonarQube Server format (use -fmt=sonarqube gosec option). Note: this property is the one from the Generic Issue Import Format
Java	sonar.java.spotbugs.reportPaths	SpotBugs, FindSecBugs, or FindBugs report in XML format that specifies: • sourcepath, a colon separated list of source folders that is essential for SonarQube to map the files. • xml:withMessages, that maps to the generated report file. Check out the spotbugs-example project on Github that contains two xml examples.
Java	sonar.java.pmd.reportPaths	Comma-delimited list of paths to reports from PMD
Java	sonar.java.checkstyle.reportPaths	Comma-delimited list of paths to reports from Checkstyle
JavaScript/Typescript	• sonar.eslint.reportPaths • sonar.typescript.tslint.reportPaths	• Comma-delimited list of paths to JSON ESLint reports (use -f json ESLint option). Example: eslint ./ -f json > eslint-report.jsonsonar -Dsonar.eslint.reportPaths=eslint-report.json • eslint ./ -f json > eslint-report.json • sonar -Dsonar.eslint.reportPaths=eslint-report.json • Comma-delimited list of paths to TSLint reports in JSON format (use -t json TSLint option) See the ESLint section of the Javascript/Typescript/CSS page for more information.
Kotlin	sonar.androidLint.reportPaths	Comma-delimited list of paths to AndroidLint reports
Kotlin	sonar.kotlin.detekt.reportPaths	Comma-delimited list of paths to Detekt reports
Kotlin	sonar.kotlin.ktlint.reportPaths	Comma-delimited list of paths to Ktlint reports
PHP	sonar.php.psalm.reportPaths	Comma-delimited list of paths to Psalm reports. Reports should be generated in the generic issue format (run Psalm with the option --output-format sonarqube).
PHP	sonar.php.phpstan.reportPaths	Comma-delimited list of paths to PHPStan reports. Reports should be generated in the PHPStan JSON Output Format (use the PHPStan analyse command with the option --error-format=json).
Python	sonar.python.pylint.reportPaths	Comma-delimited list of paths to Pylint reports (use --output-format=parseablePylint option)
Python	sonar.python.bandit.reportPaths	Comma-delimited list of paths to Bandit reports
Python	sonar.python.flake8.reportPaths	Comma-delimited list of paths to Flake8 reports
Python	sonar.python.mypy.reportPaths	Comma-delimited list of paths to Mypy reports
Python	sonar.python.ruff.reportPaths	Comma-delimited list of paths to Ruff reports.
Ruby	sonar.ruby.rubocop.reportPaths	Comma-delimited list of paths to Rubocop reports
Scala	sonar.scala.scalastyle.reportPaths	Comma-delimited list of paths to Scalastyle reports
Scala	sonar.scala.scapegoat.reportPaths	Comma-delimited list of paths to Scapegoat reports in the Scalastyle format
Swift	sonar.swift.swiftLint.reportPaths	Comma-delimited list of paths to SwiftLint reports in JSON format. Use the --reporter json option.
Terraform	sonar.terraform.tflint.reportPaths	Comma-delimited list of paths to TFLint reports in JSON format

External .NET issues

Issues from third-party Roslyn analyzers (including Roslyn analyzers provided by Microsoft) are included in the MSBuild output and imported by default into SonarQube Server therefore, no properties exist to enable that behavior. Instead, properties are available to adjust the import and to stop importing those issues.

Language	Property	Remarks
C#	sonar.cs.roslyn.ignoreIssues	Set to true to disable import of external issues. Defaults to false.
C#	sonar.cs.roslyn.bugCategories``sonar.cs.roslyn.vulnerabilityCategories``sonar.cs.roslyn.codeSmellCategories	Comma-delimited list of categories whose issues should be classified as Bugs, Vulnerabilities, or Code Smells in Standard Experience, or Reliability, Security, or Maintainability in MQR mode.
VB.NET	sonar.vbnet.roslyn.ignoreIssues	Set to true to disable import of external issues. Defaults to false.
VB.NET	sonar.vbnet.roslyn.bugCategories``sonar.vbnet.roslyn.vulnerabilityCategories``sonar.vbnet.roslyn.codeSmellCategories	Comma-delimited list of categories whose issues should be classified as Bugs, Vulnerabilities, or Code Smells in Standard Experience, or Reliability, Security, or Maintainability in MQR mode.

Note that Roslyn issues with an error severity automatically fail the build. We don’t recommend running the Scanner for .NET’s end step if the MSBuild step fails for any reason because it will result in an essentially empty analysis.

External issue lifecycle

The lifecycle of external issues is identical to the lifecycle of internal issues. This means that you can resolve an external issue the same way you would resolve an internal issue. For details, see Managing issues.

Note that managing an external issue within SonarQube Server has no impact on its state in the external tool. For example, when you mark an issue as false positive in SonarQube Server, it is not reflected in the external tool.

Limitation

External issues have an important limitation. The activation of the rules that raise these issues cannot be managed within SonarQube Server. External rules are not visible on the Rules page or reflected in any quality profile.