SARIF is an OASIS standard JSON format for static analysis results. A tool that exports it lets you combine findings from different scanners, move between vendors and feed dashboards without custom converters. When comparing tools, check the export on a real scan, not only the feature list.
What SARIF is
The specification, version 2.1.0, is an OASIS Standard published in 2020. Its stated purpose is to define a standard format for the output of static analysis tools so developers can combine results from different tools without converting each tool's unique output. The copy we reviewed is the Errata 01 edition dated 28 August 2023.
Files are JSON, encoded in UTF-8, and typically use the .sarif extension.
What a file contains
At the top is a log with one or more runs. Each run holds tool metadata, the artifacts scanned and the results. According to the specification it also covers:
- Locations and regions, pointing to files, lines, columns or byte ranges, plus logical locations such as classes or methods.
- Fingerprints for tracking results over time and baselines for comparing runs.
- Suppressions, so a dismissed finding can be recorded.
- Fixes and code flows, which describe a suggested change or the path through code that leads to a problem.
The code flow idea matters for taint-style findings, since a developer wants to see the path, not just the sink.
Why it matters for buyers
Three practical reasons.
Lock-in. Findings in a proprietary format are stuck. SARIF export means a future tool can import history, or you can keep old results for audit.
Combination. Teams often run more than one scanner. A shared format lets one dashboard or ticketing flow handle all of them.
Evidence. A standard file attached to a build is easier to archive and review than screenshots.
Test the export in a pilot
Do not stop at checking a box.
- Export SARIF from a real scan.
- Validate that the file parses with a generic viewer or script.
- Check that locations are correct by opening three findings and comparing with the source.
- See whether fingerprints stay stable between two runs of unchanged code. If they change every run, tracking over time will be painful.
- Confirm suppressions are exported or documented as not exported.
- Try importing it into whatever dashboard or tracker you use.
Limits
A shared format does not guarantee equivalent meaning. Severity scales, rule identifiers and descriptions still differ per tool. Expect some mapping work when you combine sources.
OWASP lists output interoperability, with SARIF as an example, among its criteria for choosing a source code analysis tool, so asking for it is mainstream.
Quick check
Is SARIF only for static analysis?
Per the specification, it is a format for the output of static analysis tools. Other tool types use different formats.
Does SARIF support remove the need for a dashboard?
No. It standardizes the data. You still need somewhere to view, assign and track findings.
Sources
Last reviewed: 19 October 2026.
