.NET code and supporting files for working with the 'Static Analysis Results Interchange Format' (SARIF, see https://github.com/sarif-standard/sarif-spec)
C# C TypeScript C++ PowerShell Batchfile Other
Latest commit 76c6c91 Jul 9, 2018
Failed to load latest commit information.
.nuget Move NuGet.Config to solution dir Dec 18, 2017
appveyor Change output format for sarif file no BOM Aug 4, 2016
docs Fix typo in how-to Jun 28, 2016
src Provide an --insert command that accepts a semicolon-delimited list o… Jul 9, 2018
.coby.yml touch file to reset appveyor Dec 15, 2017
.gitattributes Preliminary content. Data model, core library, and unit tests build. … Nov 18, 2015
.gitignore Merge pull request #854 from Microsoft/dev/evmaus-ms/sarif-v2-typescript Apr 26, 2018
BeforeBuild.cmd PR feedback round 2 Apr 20, 2018
BeforeBuild.sh Fix #631, #651, #658: Schema changes and build fixes (#660) Oct 30, 2017
BuildAndTest.cmd Restore Everything.sln Apr 19, 2018
BuildAndTest.ps1 Fix #654 Exit Powershell Process on completing registry settings Oct 25, 2017
BuildAndTest.sh NET Core Port (#624) Oct 5, 2017
BuildPackages.cmd Small fixes to versioning for pre-release packages. May 15, 2018
BuildPackagesFromLayoutDirectory.cmd Small fixes to versioning for pre-release packages. May 15, 2018
CreateLayoutDirectory.cmd Be consistent in label referencing syntax Dec 19, 2017
DelistCurrentPackages.cmd Various package generation fixes. Dec 13, 2017
GeneratedKey.snk Local and global suppressions + one fix Nov 10, 2017
LICENSE Add license Nov 18, 2015
PublishSignedPackages.cmd Update version & CommandLineParser package ref Jan 16, 2018
README.md Updated readme and fixed issue where nuget restore wasn't restoring t… Oct 16, 2017
RegistrySettings.ps1 Open Sarif Files in VS by Default Oct 16, 2017
RunUnitTests.ps1 PR feedback round 2 Apr 20, 2018
SetCurrentVersion.cmd Small fixes to versioning for pre-release packages. May 15, 2018
SetCurrentVersion.sh Bump to 1.7.5 Mar 20, 2018
appveyor.yml Restore Everything.sln Apr 19, 2018
dotnet-install.ps1 NET Core Port (#624) Oct 5, 2017



The SARIF SDK contains .NET code and supporting files for working with the Static Analysis Results Interchange Format (SARIF). For more information about SARIF, see the SARIF Home Page. You can read the SARIF specification, or file issues in the SARIF GitHub repo.

Getting started

To add the SARIF SDK to your project, install the Sarif.Sdk NuGet package. Sarif.Sdk depends on Newtonsoft.Json, which is installed automatically when you install Sarif.Sdk.

The types in the SARIF SDK are in the Microsoft.CodeAnalysis.Sarif namespace.

The SARIF SDK provides a set of classes which represent the elements of the SARIF format. We refer to this as the "SARIF object model". The root type that represents a SARIF log file is SarifLog. Other types in the SARIF object model are Result, PhysicalLocation, etc..

Note: The SARIF SDK's build process automatically generates the SARIF object model classes from the SARIF JSON schema, which you can find at src/Sarif/Schemata/Sarif.schema.json. Although these files do exist in the repo (under src/Sarif/Autogenerated), you should never edit them by hand.

In addition to the object model, the SARIF SDK provides a set of helper classes to facilitate using Newtonsoft.Json to read and write SARIF log files.

Building the SDK

If you want to build the SDK from source, rather than consuming the NuGet package, proceed as follows:

  1. Install .NET Core SDK 2.0 from https://www.microsoft.com/net/download/core

  2. Ensure that Visual Studio 2017 is installed on your machine.

    You can build in VS 2017, but at present the build requires certain assemblies that are supplied only in VS 2015, so it must be present.

  3. Ensure that your Visual Studio installation includes the components that support

    • C# development
    • C++ development
    • Visual Studio extension (VSIX) development
  4. Open a Visual Studio 2017 Developer Command Prompt Window.

  5. From the root directory of your local repo, run the command BuildAndTest.cmd. This restores all necessary NuGet packages, builds the SDK, and runs all the tests.

    All build output appears in the bld\ subdirectory of the repo root directory.

    NOTE: You must run BuildAndTest.cmd once before attempting to build in Visual Studio, to ensure that all required NuGet packages are available.

  6. After you have run BuildAndTest.cmd once, you can open any of the solution files in the src\ directory in Visual Studio 2017, and build them by running Rebuild Solution.


  1. Run BuildAndTest.ps1 to
    • Build,
    • Install the SARIF Visual Studio Extension and
    • Add Registry settings to open the .SARIF in Visual Studio.

Accomplishing common tasks

To learn how to accomplish common tasks with the SARIF SDK, such as reading and writing files from disk, see the How To page.

Code of conduct

This project has adopted the Microsoft Open Source Code of Conduct. For more information, see the Code of Conduct FAQ, or contact opencode@microsoft.com with any additional questions or comments.