Count SARIF results by both kind and level. Kind says what sort of result it is (pass, fail, open, review, informational, notApplicable). Level says severity for failures (error, warning, note, none). Counting every result as a finding inflates your numbers and hides what matters.
What the specification defines
In SARIF 2.1.0, a result may contain a kind property. When present, it takes one of a fixed set of values. A pass means the rule was evaluated and no problem was found. An open result means the tool had insufficient information to decide. An informational result is purely informational and does not indicate a problem. NotApplicable means the rule was not evaluated for the target. There are also fail and review values.
A result may also contain a level. Warning means a problem was found. Error means a serious problem was found. Note means a minor problem or an opportunity to improve. None means severity does not apply because the kind is something other than fail.
Two details matter for counting. The kind property is optional, and the level is meant to be none when the kind is not fail. In practice, many tools omit kind and use level alone, so check what yours emits before building charts.
A counting table
| Kind | Level | Count as |
|---|---|---|
| fail | error | High severity finding |
| fail | warning | Finding |
| fail | note | Low priority finding |
| open | any | Needs review, count separately |
| review | any | Needs human decision, count separately |
| pass, informational, notApplicable | none | Do not count as findings |
Steps
- Take one real SARIF file from your scanner and read the kind and level of ten results by hand.
- Write down what your tool means by each level. Level is not the same as CVSS severity. Map them explicitly if you need to.
- Add the kind and level to your stored records, not just a total.
- Report findings as fail results, and report open and review results as a separate backlog.
- Re-check the mapping whenever you upgrade the scanner.
Common mistakes
- Counting the length of the results array as the number of findings. If the tool writes passes into the file, the count is wrong.
- Treating note as noise and dropping it permanently. Notes can be useful for trend analysis even if they never block a build.
- Mixing levels from different tools in one chart without a mapping.
Why it matters for decisions
Gate rules usually key off level. If a tool marks something as a warning that you consider critical, no amount of charting fixes the mismatch. Review level assignments with the people who respond to the findings, and agree what blocks and what only informs.
Quick check
Is SARIF level the same as severity?
Not exactly. It is a coarse scale defined by the format. Tools often carry a separate numeric score or custom property for finer severity.
What if my tool never sets kind?
Then treat results as findings and rely on level, but confirm by reading a sample. The kind property is optional in the standard.
How Safeguard fits
Safeguard's policies and gates work with dependency and SBOM scanning results so teams can decide what blocks and what informs. Try a free scan at gold.safeguard.sh/scan.
Sources
- OASIS, SARIF Version 2.1.0, sections on result kind and level: https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html
Last reviewed: 19 October 2026.
