Exports
Security hands its results to the tools you already run in two forms: code findings as a SARIF file, and a detection rule in Sigma that an investigation drafted. You import the SARIF file into your own tools and review the rule before it goes into your SIEM.
SARIF export of code findings
Section titled “SARIF export of code findings”Export SARIF on the Findings tab downloads olympusx-findings.sarif: the code findings the filters keep, as SARIF 2.1.0. Admins, builders and auditors can export.
- Open Use cases › Security and select the Findings tab.
- Set the filters. Status decides which findings go: Open exports open findings and Dismissed exports dismissed ones. Open and dismissed exports open findings only, so export Dismissed separately to include them. Severity and Source narrow it further.
- Select Export SARIF. The button is unavailable while the list is empty.
Every finding the filter keeps is exported, including those past the 500 the list shows. Each export is recorded in the audit log.
What the file holds
Section titled “What the file holds”| SARIF element | Content |
|---|---|
runs |
One run per repository, in path order. The run’s properties.repository names it, and result paths are relative to its root. |
tool.driver.name |
Olympusx security assessment |
rules |
One rule per weakness class: its CWE (with a helpUri to the CWE definition), or OLYMPUS-UNCLASSIFIED for findings that name none. |
results[].level |
error for critical and high, warning for medium, note for low and information. |
results[].message.text |
The title, the reason it may be exploitable, and the suggested fix. |
results[].locations |
The file path, start line and end line. |
results[].partialFingerprints |
olympusFingerprint/v1: Olympusx AI’s own fingerprint, so a tool that imports twice tells a finding seen again from a new one. |
results[].properties |
severity, confidence, proof (reasoned only), status, model, firstSeen and lastSeen. |
Import the file into any tool that reads SARIF 2.1.0, such as your code host’s code-scanning view.
Sigma rules from investigations
Section titled “Sigma rules from investigations”When an investigation of a log source ends with a suspicious or malicious verdict, the model may draft a detection rule that would catch the same behaviour next time. The investigation’s page shows it under Detection rule (Sigma, draft), with a copy button.
- Olympusx AI keeps a draft only when it parses as YAML with a
title, alogsourceand adetectionwith acondition. A draft is at most 8,000 characters. - Investigations of the Olympusx AI audit log do not draft rules.
- Investigations opened by an alert draft them in the same way.
To use one:
- Open the investigation and copy the rule.
- Check its field names and values against your log schema: they come from the events the model saw, mapped as your log source maps them.
- Test it in your SIEM before you enable it.