> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Rule-based SAST
> Run rule-based static analysis on your first-party code using Opengrep.
Rule-based SAST in Endor Labs uses [Opengrep](https://www.opengrep.dev/) to scan your source code against a curated set of pattern-based rules. Scans are fast and deterministic and run without executing the code.
The [AI SAST triage agent](/scan/ai-sast/triage-agent) runs on top of rule-based SAST to automatically classify each finding as a true positive or false positive, cutting the manual triage effort that rule-based scans typically require.
## How rule-based SAST works
Opengrep is an open-source, static analysis tool that finds bugs and vulnerabilities in source code using pattern matching. Opengrep parses the source code, applies pattern matching based on rules, and reports matches based on the rule specifications. Opengrep rules are in the YAML format.
When you run a SAST scan, Endor Labs downloads Opengrep and works seamlessly. If you wish, you can use Semgrep instead of Opengrep with Endor Labs.
If you use Semgrep with Endor Labs, SAST scan is supported on macOS and Linux, and not supported on Windows.
Endor Labs includes a set of [curated rules](/scan/sast/manage-sast-rules). You can [create your own rules](/scan/sast/manage-sast-rules/create-sast-rule) or [import rules](/scan/sast/manage-sast-rules/import-sast-rule) with the rule designer.
Enable the [default SAST finding policies](/platform-administration/policies/finding-policies/sast-policies) to generate findings from SAST scans.
When you [scan with the SAST option enabled](/scan/sast/run-a-sast-scan), Endor Labs uses Opengrep to scan for weaknesses in your source code based on SAST rules and generates findings based on the configured finding policies.
Endor Labs does not scan the files included in the `.gitignore` files during SAST scan. You can also use the `nosemgrep` annotation in the code to skip SAST scan. Refer to the [Semgrep Documentation](https://semgrep.dev/docs/ignoring-files-folders-code#ignore-code-through-nosemgrep) for more information.
Login to [Endor Labs](https://app.endorlabs.com/login) to view the findings of a SAST scan. See [View SAST findings](/scan/sast/viewing-sast-findings) for more information.
You can create exception policies to exclude results from the findings page. See [create exception policy](/scan/sast/create-exception-policy) for more information.
You can create a finding policy using predefined templates to control which SAST results appear as findings. See [SAST policies](/platform-administration/policies/finding-policies/sast-policies) for more information.
## SAST severity matrix
Endor Labs determines the severity of findings by combining two factors from the SAST rule: impact and confidence. Impact measures the potential consequences of exploiting a security issue. Confidence represents the certainty that a detected pattern is a genuine security issue rather than a false positive. If either factor cannot be determined, the severity defaults to low.
The following matrix shows how Endor Labs resolves severity by combining impact and confidence.
| High Impact |
Medium |
High |
Critical |
| Medium Impact |
Low |
Medium |
High |
| Low Impact |
Low |
Low |
Medium |
|
Low Confidence |
Medium Confidence |
High Confidence |
For ways to run a SAST scan, and incremental scan behavior, see [SAST overview](/scan/sast).
## Language support
Endor Labs supports single-function analysis for the following languages through curated rules and custom user rules:
```shell expandable theme={null}
- Apex
- Bash
- C
- Cairo
- Circom
- Clojure
- C++
- C#
- Dart
- Dockerfile
- Elixir
- Generic
- Go
- Hack
- HTML
- Java
- JavaScript
- JSON
- Jsonnet
- Julia
- Kotlin
- Lisp
- Lua
- Move
- OCaml
- PHP
- PromQL
- Protobuf
- Python
- QL
- R
- Regex
- Ruby
- Rust
- Scala
- Scheme
- Solidity
- Swift
- Terraform
- TypeScript
- XML
- YAML
```