Does AppGuard support Checkov custom policies?

Yes. Checkov custom policies run locally and produce standard SARIF output. AppGuard ingests all findings regardless of whether they come from built-in or custom policies.

Can I scan Kubernetes manifests with Checkov?

Yes. Checkov supports Kubernetes manifests, Helm charts, and Kustomize. Push the results to AppGuard for centralized IaC security tracking.

Supported/IaC

Checkov + AppGuard

Name: AppGuard
Brand: servasec

Static analysis for infrastructure as code. Scans Terraform, CloudFormation, Kubernetes, and more for misconfigurations.

What is Checkov?

Checkov is a static analysis tool for infrastructure as code (IaC) by Bridgecrew (now part of Palo Alto Prisma Cloud). It scans Terraform, CloudFormation, Kubernetes, Helm, ARM templates, Serverless, and more for security misconfigurations. Checkov includes over 1000 built-in policies covering security and compliance best practices.

1000+ built-in policiesTerraform, CloudFormation, K8s supportGraph-based scanningCompliance checking (SOC2, HIPAA, PCI-DSS)Custom policy support (Python)

Integrate Checkov with AppGuard

Install Checkov

Install Checkov via pip.

pip install checkov

Scan your IaC

Run Checkov against your Terraform or CloudFormation files.

checkov -d . --output sarif > results.sarif

Push to AppGuard

Send the results to AppGuard.

curl -X POST "$APPGUARD_PUBLIC_URL/api/ingest" \
  -H "X-Api-Token: $API_TOKEN" \
  -F "[email protected]"

What AppGuard adds to Checkov

IaC + application correlation

See infrastructure misconfigurations alongside application security findings.

Remediation tracking

Track IaC misconfigurations through their lifecycle from detection to fix.

Team assignments

Assign IaC findings to the right team members with due dates.

Try Checkov with AppGuard

Self-host AppGuard and connect Checkov in minutes. AGPLv3 licensed, full data ownership.