SONAR-22603 Use generated code for the SARIF parser

49 files changed, 3671 insertions, 1575 deletions

diff --git a/build.gradle b/build.gradle
index 0996c62e3c2..0deaf749295 100644
--- a/build.gradle
+++ b/build.gradle
@@ -483,7 +483,8 @@ subprojects {
       dependency ("org.apache.velocity:velocity:1.7") {
         dependency 'commons-collections:commons-collections:3.2.2'
       }
-
+      dependency 'com.fasterxml.jackson.core:jackson-databind:2.17.1'
+      dependency 'com.google.code.findbugs:jsr305:3.0.2'
       // please keep this list alphabetically ordered
     }
   }
diff --git a/settings.gradle b/settings.gradle
index 22d2fa50fdb..d38de2a4534 100644
--- a/settings.gradle
+++ b/settings.gradle
@@ -61,6 +61,7 @@ include 'server:sonar-webserver-monitoring'
 
 include 'sonar-application'
 include 'sonar-core'
+include 'sonar-sarif'
 include 'sonar-duplications'
 include 'sonar-markdown'
 include 'sonar-plugin-api-impl'
diff --git a/sonar-application/build.gradle b/sonar-application/build.gradle
index 9b2bfee02af..3c7f333dc53 100644
--- a/sonar-application/build.gradle
+++ b/sonar-application/build.gradle
@@ -338,7 +338,7 @@ task zip(type: Zip, dependsOn: [configurations.compileClasspath]) {
 // Check the size of the archive
 zip.doLast {
   def minLength = 340000000
-  def maxLength = 744000000
+  def maxLength = 745000000
 
   def length = archiveFile.get().asFile.length()
   if (length < minLength)
diff --git a/sonar-core/build.gradle b/sonar-core/build.gradle
index e14941e5f6c..053c84335d0 100644
--- a/sonar-core/build.gradle
+++ b/sonar-core/build.gradle
@@ -1,9 +1,3 @@
-sonar {
-  properties {
-    property 'sonar.projectName', "${projectTitle} :: Core"
-  }
-}
-
 dependencies {
   // please keep list ordered
 
@@ -23,6 +17,7 @@ dependencies {
   api 'org.springframework:spring-context'
   api project(':sonar-plugin-api-impl')
   api project(':sonar-ws')
+  api project(':sonar-sarif')
 
   compileOnlyApi 'com.github.spotbugs:spotbugs-annotations'
   compileOnlyApi 'com.google.code.gson:gson'
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/ArtifactLocation.java b/sonar-core/src/main/java/org/sonar/core/sarif/ArtifactLocation.java
deleted file mode 100644
index d44ed689079..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/ArtifactLocation.java
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-import javax.annotation.CheckForNull;
-import javax.annotation.Nullable;
-
-public class ArtifactLocation {
-
-  @SerializedName("uri")
-  private final String uri;
-  @SerializedName("uriBaseId")
-  private final String uriBaseId;
-
-  public ArtifactLocation(@Nullable String uriBaseId, String uri) {
-    this.uriBaseId = uriBaseId;
-    this.uri = uri;
-  }
-
-  public String getUri() {
-    return uri;
-  }
-
-  @CheckForNull
-  public String getUriBaseId() {
-    return uriBaseId;
-  }
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/CodeFlow.java b/sonar-core/src/main/java/org/sonar/core/sarif/CodeFlow.java
deleted file mode 100644
index 5e91d98af6b..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/CodeFlow.java
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-import java.util.List;
-
-public class CodeFlow {
-  @SerializedName("threadFlows")
-  private final List<ThreadFlow> threadFlows;
-
-  private CodeFlow(List<ThreadFlow> threadFlows) {
-    this.threadFlows = threadFlows;
-  }
-
-  public static CodeFlow of(List<ThreadFlow> threadFlows) {
-    return new CodeFlow(threadFlows);
-  }
-
-  public List<ThreadFlow> getThreadFlows() {
-    return threadFlows;
-  }
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/DefaultConfiguration.java b/sonar-core/src/main/java/org/sonar/core/sarif/DefaultConfiguration.java
deleted file mode 100644
index 4d37f322c4a..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/DefaultConfiguration.java
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-
-public class DefaultConfiguration {
-  @SerializedName("level")
-  private String level;
-
-  DefaultConfiguration() {}
-
-  public String getLevel() {
-    return level;
-  }
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/Driver.java b/sonar-core/src/main/java/org/sonar/core/sarif/Driver.java
deleted file mode 100644
index 5658be2e9e3..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/Driver.java
+++ /dev/null
@@ -1,100 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-import java.util.Set;
-import javax.annotation.CheckForNull;
-import javax.annotation.Nullable;
-
-public class Driver {
-
-  @SerializedName("name")
-  private final String name;
-  @SerializedName("organization")
-  private final String organization;
-  @SerializedName("semanticVersion")
-  private final String semanticVersion;
-  @SerializedName("rules")
-  private final Set<Rule> rules;
-
-  private Driver(String name, @Nullable String organization, @Nullable String semanticVersion, Set<Rule> rules) {
-    this.name = name;
-    this.organization = organization;
-    this.semanticVersion = semanticVersion;
-    this.rules = Set.copyOf(rules);
-  }
-
-  public String getName() {
-    return name;
-  }
-
-  @CheckForNull
-  public String getOrganization() {
-    return organization;
-  }
-
-  @CheckForNull
-  public String getSemanticVersion() {
-    return semanticVersion;
-  }
-
-  public Set<Rule> getRules() {
-    return rules;
-  }
-
-  public static DriverBuilder builder() {
-    return new DriverBuilder();
-  }
-
-  public static final class DriverBuilder {
-    private String name;
-    private String organization;
-    private String semanticVersion;
-    private Set<Rule> rules;
-
-    private DriverBuilder() {
-    }
-
-    public DriverBuilder name(String name) {
-      this.name = name;
-      return this;
-    }
-
-    public DriverBuilder organization(String organization) {
-      this.organization = organization;
-      return this;
-    }
-
-    public DriverBuilder semanticVersion(String semanticVersion) {
-      this.semanticVersion = semanticVersion;
-      return this;
-    }
-
-    public DriverBuilder rules(Set<Rule> rules) {
-      this.rules = rules;
-      return this;
-    }
-
-    public Driver build() {
-      return new Driver(name, organization, semanticVersion, rules);
-    }
-  }
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/Extension.java b/sonar-core/src/main/java/org/sonar/core/sarif/Extension.java
deleted file mode 100644
index 1e7b16c37bf..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/Extension.java
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-import java.util.Set;
-import javax.annotation.CheckForNull;
-
-public class Extension {
-  @SerializedName("rules")
-  private Set<Rule> rules;
-  @SerializedName("name")
-  private String name;
-
-  public Extension() {
-    // even if empty constructor is not required for Gson, it is strongly recommended:
-    // http://stackoverflow.com/a/18645370/229031
-  }
-
-  @CheckForNull
-  public Set<Rule> getRules() {
-    return rules;
-  }
-
-  public String getName() {
-    return name;
-  }
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/Location.java b/sonar-core/src/main/java/org/sonar/core/sarif/Location.java
deleted file mode 100644
index 14f4f24885e..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/Location.java
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-
-public class Location {
-  @SerializedName("physicalLocation")
-  private final PhysicalLocation physicalLocation;
-
-  private Location(PhysicalLocation physicalLocation) {
-    this.physicalLocation = physicalLocation;
-  }
-
-  public static Location of(PhysicalLocation physicalLocation) {
-    return new Location(physicalLocation);
-  }
-
-  public PhysicalLocation getPhysicalLocation() {
-    return physicalLocation;
-  }
-
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/LocationWrapper.java b/sonar-core/src/main/java/org/sonar/core/sarif/LocationWrapper.java
deleted file mode 100644
index d7b1b43180e..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/LocationWrapper.java
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-
-public class LocationWrapper {
-  @SerializedName("location")
-  private final Location location;
-
-  private LocationWrapper(Location location) {
-    this.location = location;
-  }
-
-  public static LocationWrapper of(Location location)  {
-    return new LocationWrapper(location);
-  }
-
-  public Location getLocation() {
-    return location;
-  }
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/PartialFingerprints.java b/sonar-core/src/main/java/org/sonar/core/sarif/PartialFingerprints.java
deleted file mode 100644
index 6cbd134b961..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/PartialFingerprints.java
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-
-public class PartialFingerprints {
-  @SerializedName("primaryLocationLineHash")
-  private final String primaryLocationLineHash;
-
-  public PartialFingerprints(String primaryLocationLineHash) {
-    this.primaryLocationLineHash = primaryLocationLineHash;
-  }
-
-  public String getPrimaryLocationLineHash() {
-    return primaryLocationLineHash;
-  }
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/PhysicalLocation.java b/sonar-core/src/main/java/org/sonar/core/sarif/PhysicalLocation.java
deleted file mode 100644
index 0e89d8fc977..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/PhysicalLocation.java
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-
-public class PhysicalLocation {
-  @SerializedName("artifactLocation")
-  private final ArtifactLocation artifactLocation;
-  @SerializedName("region")
-  private final Region region;
-
-  private PhysicalLocation(ArtifactLocation artifactLocation, Region region) {
-    this.artifactLocation = artifactLocation;
-    this.region = region;
-  }
-
-  public static PhysicalLocation of(ArtifactLocation artifactLocation, Region region) {
-    return new PhysicalLocation(artifactLocation, region);
-  }
-
-  public ArtifactLocation getArtifactLocation() {
-    return artifactLocation;
-  }
-
-  public Region getRegion() {
-    return region;
-  }
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/PropertiesBag.java b/sonar-core/src/main/java/org/sonar/core/sarif/PropertiesBag.java
deleted file mode 100644
index 5a881e0567c..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/PropertiesBag.java
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-import java.util.Set;
-
-public class PropertiesBag {
-  @SerializedName("tags")
-  private final Set<String> tags;
-  @SerializedName("security-severity")
-  private final String securitySeverity;
-
-  private PropertiesBag(String securitySeverity, Set<String> tags) {
-    this.tags = Set.copyOf(tags);
-    this.securitySeverity = securitySeverity;
-  }
-
-  public static PropertiesBag of(String securitySeverity, Set<String> tags) {
-    return new PropertiesBag(securitySeverity, tags);
-  }
-
-  public Set<String> getTags() {
-    return tags;
-  }
-
-  public String getSecuritySeverity() {
-    return securitySeverity;
-  }
-  
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/Region.java b/sonar-core/src/main/java/org/sonar/core/sarif/Region.java
deleted file mode 100644
index 9e174235b70..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/Region.java
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-import javax.annotation.CheckForNull;
-import javax.annotation.Nullable;
-
-public class Region {
-  @SerializedName("startLine")
-  private final Integer startLine;
-  @SerializedName("endLine")
-  private final Integer endLine;
-  @SerializedName("startColumn")
-  private final Integer startColumn;
-  @SerializedName("endColumn")
-  private final Integer endColumn;
-
-  private Region(Integer startLine, @Nullable Integer endLine, @Nullable Integer startColumn, @Nullable Integer endColumn) {
-    this.startLine = startLine;
-    this.endLine = endLine;
-    this.startColumn = startColumn;
-    this.endColumn = endColumn;
-  }
-
-  public static RegionBuilder builder() {
-    return new RegionBuilder();
-  }
-
-  public Integer getStartLine() {
-    return startLine;
-  }
-
-  @CheckForNull
-  public Integer getEndLine() {
-    return endLine;
-  }
-
-  @CheckForNull
-  public Integer getStartColumn() {
-    return startColumn;
-  }
-
-  @CheckForNull
-  public Integer getEndColumn() {
-    return endColumn;
-  }
-
-  public static final class RegionBuilder {
-    private Integer startLine;
-    private Integer endLine;
-    private Integer startColumn;
-    private Integer endColumn;
-
-    public RegionBuilder startLine(int startLine) {
-      this.startLine = startLine;
-      return this;
-    }
-
-    public RegionBuilder endLine(int endLine) {
-      this.endLine = endLine;
-      return this;
-    }
-
-    public RegionBuilder startColumn(int startColumn) {
-      this.startColumn = startColumn;
-      return this;
-    }
-
-    public RegionBuilder endColumn(int endColumn) {
-      this.endColumn = endColumn;
-      return this;
-    }
-
-    public Region build() {
-      return new Region(startLine, endLine, startColumn, endColumn);
-    }
-  }
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/Result.java b/sonar-core/src/main/java/org/sonar/core/sarif/Result.java
deleted file mode 100644
index 8ce0537dc68..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/Result.java
+++ /dev/null
@@ -1,129 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Set;
-import javax.annotation.CheckForNull;
-import javax.annotation.Nullable;
-
-public class Result {
-  @SerializedName("ruleId")
-  private final String ruleId;
-  @SerializedName("message")
-  private final WrappedText message;
-  @SerializedName("locations")
-  private final LinkedHashSet<Location> locations;
-  @SerializedName("partialFingerprints")
-  private final PartialFingerprints partialFingerprints;
-  @SerializedName("codeFlows")
-  private final List<CodeFlow> codeFlows;
-  @SerializedName("level")
-  private final String level;
-
-  private Result(String ruleId, String message, @Nullable LinkedHashSet<Location> locations,
-    @Nullable String primaryLocationLineHash, @Nullable List<CodeFlow> codeFlows, @Nullable String level) {
-    this.ruleId = ruleId;
-    this.message = WrappedText.of(message);
-    this.locations = locations;
-    this.partialFingerprints = primaryLocationLineHash == null ? null : new PartialFingerprints(primaryLocationLineHash);
-    this.codeFlows = codeFlows == null ? null : List.copyOf(codeFlows);
-    this.level = level;
-  }
-
-  public String getRuleId() {
-    return ruleId;
-  }
-
-  public WrappedText getMessage() {
-    return message;
-  }
-
-  @CheckForNull
-  public Set<Location> getLocations() {
-    return locations;
-  }
-
-  @CheckForNull
-  public PartialFingerprints getPartialFingerprints() {
-    return partialFingerprints;
-  }
-
-  @CheckForNull
-  public List<CodeFlow> getCodeFlows() {
-    return codeFlows;
-  }
-
-  public String getLevel() {
-    return level;
-  }
-
-  public static ResultBuilder builder() {
-    return new ResultBuilder();
-  }
-
-  public static final class ResultBuilder {
-    private String ruleId;
-    private String message;
-    private LinkedHashSet<Location> locations;
-    private String hash;
-    private List<CodeFlow> codeFlows;
-    private String level;
-
-    private ResultBuilder() {
-    }
-
-    public ResultBuilder ruleId(String ruleId) {
-      this.ruleId = ruleId;
-      return this;
-    }
-
-    public ResultBuilder message(String message) {
-      this.message = message;
-      return this;
-    }
-
-    public ResultBuilder level(String level) {
-      this.level = level;
-      return this;
-    }
-
-    public ResultBuilder locations(Set<Location> locations) {
-      this.locations = new LinkedHashSet<>(locations);
-      return this;
-    }
-
-    public ResultBuilder hash(String hash) {
-      this.hash = hash;
-      return this;
-    }
-
-    public ResultBuilder codeFlows(List<CodeFlow> codeFlows) {
-      this.codeFlows = codeFlows;
-      return this;
-    }
-
-    public Result build() {
-      return new Result(ruleId, message, locations, hash, codeFlows, level);
-    }
-  }
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/Rule.java b/sonar-core/src/main/java/org/sonar/core/sarif/Rule.java
deleted file mode 100644
index f212513756d..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/Rule.java
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-import java.util.Objects;
-
-public class Rule {
-  @SerializedName("id")
-  private final String id;
-  @SerializedName("name")
-  private final String name;
-  @SerializedName("shortDescription")
-  private final WrappedText shortDescription;
-  @SerializedName("fullDescription")
-  private final WrappedText fullDescription;
-  @SerializedName("help")
-  private final WrappedText help;
-  @SerializedName("properties")
-  private final PropertiesBag properties;
-  @SerializedName("defaultConfiguration")
-  private DefaultConfiguration defaultConfiguration;
-
-  private Rule(String id, String name, WrappedText shortDescription, WrappedText fullDescription, WrappedText help, PropertiesBag properties) {
-    this.id = id;
-    this.name = name;
-    this.shortDescription = shortDescription;
-    this.fullDescription = fullDescription;
-    this.help = help;
-    this.properties = properties;
-  }
-
-  public String getId() {
-    return id;
-  }
-
-  public String getName() {
-    return name;
-  }
-
-  public WrappedText getShortDescription() {
-    return shortDescription;
-  }
-
-  public WrappedText getFullDescription() {
-    return fullDescription;
-  }
-
-  public WrappedText getHelp() {
-    return help;
-  }
-
-  public PropertiesBag getProperties() {
-    return properties;
-  }
-
-  public DefaultConfiguration getDefaultConfiguration() {
-    return defaultConfiguration;
-  }
-
-  @Override
-  public boolean equals(Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    Rule rule = (Rule) o;
-    return Objects.equals(id, rule.id);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(id);
-  }
-
-  public static RuleBuilder builder() {
-    return new RuleBuilder();
-  }
-
-  public static final class RuleBuilder {
-    private String id;
-    private String name;
-    private WrappedText shortDescription;
-    private WrappedText fullDescription;
-    private WrappedText help;
-    private PropertiesBag properties;
-
-    private RuleBuilder() {
-    }
-
-    public RuleBuilder id(String id) {
-      this.id = id;
-      return this;
-    }
-
-    public RuleBuilder name(String name) {
-      this.name = name;
-      return this;
-    }
-
-    public RuleBuilder shortDescription(String shortDescription) {
-      this.shortDescription = WrappedText.of(shortDescription);
-      return this;
-    }
-
-    public RuleBuilder fullDescription(String fullDescription) {
-      this.fullDescription = WrappedText.of(fullDescription);
-      return this;
-    }
-
-    public RuleBuilder help(String help) {
-      this.help = WrappedText.of(help);
-      return this;
-    }
-
-    public RuleBuilder properties(PropertiesBag properties) {
-      this.properties = properties;
-      return this;
-    }
-
-    public Rule build() {
-      return new Rule(id, name, shortDescription, fullDescription, help, properties);
-    }
-  }
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/Run.java b/sonar-core/src/main/java/org/sonar/core/sarif/Run.java
deleted file mode 100644
index 5d9863f1d8f..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/Run.java
+++ /dev/null
@@ -1,101 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-import java.util.Set;
-import javax.annotation.CheckForNull;
-import javax.annotation.Nullable;
-
-public class Run {
-
-  @SerializedName("tool")
-  private final Tool tool;
-  @SerializedName("results")
-  private final Set<Result> results;
-  @SerializedName("language")
-  private final String language;
-  @SerializedName("columnKind")
-  private final String columnKind;
-
-  private Run(Tool tool, Set<Result> results, @Nullable String language, @Nullable String columnKind) {
-    this.tool = tool;
-    this.results = Set.copyOf(results);
-    this.language = language;
-    this.columnKind = columnKind;
-  }
-
-  @CheckForNull
-  public String getLanguage() {
-    return language;
-  }
-
-  @CheckForNull
-  public String getColumnKind() {
-    return columnKind;
-  }
-
-  public Tool getTool() {
-    return tool;
-  }
-
-  public Set<Result> getResults() {
-    return results;
-  }
-
-  public static RunBuilder builder() {
-    return new RunBuilder();
-  }
-
-  public static final class RunBuilder {
-    private Tool tool;
-    private Set<Result> results;
-    private String language;
-    private String columnKind;
-
-    private RunBuilder() {
-    }
-
-    public RunBuilder tool(Tool tool) {
-      this.tool = tool;
-      return this;
-    }
-
-    public RunBuilder results(Set<Result> results) {
-      this.results = results;
-      return this;
-    }
-
-    public RunBuilder language(String language) {
-      this.language = language;
-      return this;
-    }
-
-    public RunBuilder columnKind(String columnKind) {
-      this.columnKind = columnKind;
-      return this;
-    }
-
-    public Run build() {
-      return new Run(tool, results, language, columnKind);
-    }
-  }
-
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/Sarif210.java b/sonar-core/src/main/java/org/sonar/core/sarif/Sarif210.java
deleted file mode 100644
index 56c6756e5c3..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/Sarif210.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-import java.util.Set;
-
-public class Sarif210 {
-
-  public static final String SARIF_VERSION = "2.1.0";
-
-  @SerializedName("version")
-  private final String version;
-  @SerializedName("$schema")
-  private final String schema;
-  @SerializedName("runs")
-  private final Set<Run> runs;
-
-  public Sarif210(String schema, Run run) {
-    this.schema = schema;
-    this.version = SARIF_VERSION;
-    this.runs = Set.of(run);
-  }
-
-  public String getVersion() {
-    return version;
-  }
-
-  public String getSchema() {
-    return schema;
-  }
-
-  public Set<Run> getRuns() {
-    return runs;
-  }
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializer.java b/sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializer.java
index 69f968195ee..9cca8cb59fd 100644
--- a/sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializer.java
+++ b/sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializer.java
@@ -21,10 +21,11 @@ package org.sonar.core.sarif;
 
 import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
+import org.sonar.sarif.pojo.SarifSchema210;
 
 public interface SarifSerializer {
 
-  String serialize(Sarif210 sarif210);
+  String serialize(SarifSchema210 sarif210);
 
-  Sarif210 deserialize(Path sarifPath) throws NoSuchFileException;
+  SarifSchema210 deserialize(Path sarifPath) throws NoSuchFileException;
 }
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializerImpl.java b/sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializerImpl.java
index 360b63d8d13..61faf38cd70 100644
--- a/sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializerImpl.java
+++ b/sonar-core/src/main/java/org/sonar/core/sarif/SarifSerializerImpl.java
@@ -19,57 +19,81 @@
  */
 package org.sonar.core.sarif;
 
+import com.fasterxml.jackson.core.JsonParseException;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JsonMappingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.deser.DeserializationProblemHandler;
 import com.google.common.annotations.VisibleForTesting;
-import com.google.gson.Gson;
-import com.google.gson.JsonIOException;
-import com.google.gson.JsonSyntaxException;
 import java.io.IOException;
-import java.io.Reader;
-import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
 import javax.inject.Inject;
 import org.sonar.api.ce.ComputeEngineSide;
 import org.sonar.api.scanner.ScannerSide;
+import org.sonar.sarif.pojo.SarifSchema210;
 
 import static java.lang.String.format;
-import static java.nio.charset.StandardCharsets.UTF_8;
-import static java.nio.file.Files.newBufferedReader;
 
 @ScannerSide
 @ComputeEngineSide
 public class SarifSerializerImpl implements SarifSerializer {
   private static final String SARIF_REPORT_ERROR = "Failed to read SARIF report at '%s'";
   private static final String SARIF_JSON_SYNTAX_ERROR = SARIF_REPORT_ERROR + ": invalid JSON syntax or file is not UTF-8 encoded";
+  public static final String UNSUPPORTED_VERSION_MESSAGE_TEMPLATE = "Version [%s] of SARIF is not supported";
 
-  private final Gson gson;
+  private final ObjectMapper mapper;
 
   @Inject
   public SarifSerializerImpl() {
-    this(new Gson());
+    this(new ObjectMapper());
   }
 
   @VisibleForTesting
-  SarifSerializerImpl(Gson gson) {
-    this.gson = gson;
+  SarifSerializerImpl(ObjectMapper mapper) {
+    this.mapper = mapper;
   }
 
   @Override
-  public String serialize(Sarif210 sarif210) {
-    return gson.toJson(sarif210);
+  public String serialize(SarifSchema210 sarif210) {
+    try {
+      return mapper
+        .writerWithDefaultPrettyPrinter()
+        .writeValueAsString(sarif210);
+    } catch (JsonProcessingException e) {
+      throw new IllegalStateException("Unable to serialize SARIF", e);
+    }
   }
 
   @Override
-  public Sarif210 deserialize(Path reportPath) throws NoSuchFileException {
-    try (Reader reader = newBufferedReader(reportPath, UTF_8)) {
-      Sarif210 sarif = gson.fromJson(reader, Sarif210.class);
-      SarifVersionValidator.validateSarifVersion(sarif.getVersion());
-      return sarif;
-    } catch (NoSuchFileException e) {
-      throw e;
-    } catch (JsonIOException | IOException e) {
-      throw new IllegalStateException(format(SARIF_REPORT_ERROR, reportPath), e);
-    } catch (JsonSyntaxException e) {
+  public SarifSchema210 deserialize(Path reportPath) {
+    try {
+      return mapper
+        .enable(JsonParser.Feature.INCLUDE_SOURCE_IN_LOCATION)
+        .addHandler(new DeserializationProblemHandler() {
+          @Override
+          public Object handleInstantiationProblem(DeserializationContext ctxt, Class<?> instClass, Object argument, Throwable t) throws IOException {
+            if (!instClass.equals(SarifSchema210.Version.class)) {
+              return NOT_HANDLED;
+            }
+            throw new UnsupportedSarifVersionException(format(UNSUPPORTED_VERSION_MESSAGE_TEMPLATE, argument), t);
+          }
+        })
+        .readValue(reportPath.toFile(), SarifSchema210.class);
+    } catch (UnsupportedSarifVersionException e) {
+      throw new IllegalStateException(e.getMessage(), e);
+    } catch (JsonMappingException | JsonParseException e) {
       throw new IllegalStateException(format(SARIF_JSON_SYNTAX_ERROR, reportPath), e);
+    } catch (IOException e) {
+      throw new IllegalStateException(format(SARIF_REPORT_ERROR, reportPath), e);
+    }
+  }
+
+  private static class UnsupportedSarifVersionException extends IOException {
+
+    public UnsupportedSarifVersionException(String message, Throwable t) {
+      super(message, t);
     }
   }
 }
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/SarifVersionValidator.java b/sonar-core/src/main/java/org/sonar/core/sarif/SarifVersionValidator.java
deleted file mode 100644
index 2c4052d3926..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/SarifVersionValidator.java
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import java.util.Optional;
-import java.util.Set;
-import javax.annotation.Nullable;
-
-import static java.lang.String.format;
-import static org.sonar.core.sarif.Sarif210.SARIF_VERSION;
-
-public class SarifVersionValidator {
-  public static final Set<String> SUPPORTED_SARIF_VERSIONS = Set.of(SARIF_VERSION);
-  public static final String UNSUPPORTED_VERSION_MESSAGE_TEMPLATE = "Version [%s] of SARIF is not supported";
-
-  private SarifVersionValidator() {}
-
-  public static void validateSarifVersion(@Nullable String version) {
-    if (!isSupportedSarifVersion(version)) {
-      throw new IllegalStateException(composeUnsupportedVersionMessage(version));
-    }
-  }
-
-  private static boolean isSupportedSarifVersion(@Nullable String version) {
-    return Optional.ofNullable(version)
-      .filter(SUPPORTED_SARIF_VERSIONS::contains)
-      .isPresent();
-  }
-
-  private static String composeUnsupportedVersionMessage(@Nullable String version) {
-    return format(UNSUPPORTED_VERSION_MESSAGE_TEMPLATE, version);
-  }
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/ThreadFlow.java b/sonar-core/src/main/java/org/sonar/core/sarif/ThreadFlow.java
deleted file mode 100644
index 03119cd98e4..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/ThreadFlow.java
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-import java.util.List;
-
-public class ThreadFlow {
-  @SerializedName("locations")
-  private final List<LocationWrapper> locations;
-
-  private ThreadFlow(List<LocationWrapper> locations) {
-    this.locations = locations;
-  }
-
-  public static ThreadFlow of(List<LocationWrapper> locations) {
-    return new ThreadFlow(locations);
-  }
-
-  public List<LocationWrapper> getLocations() {
-    return locations;
-  }
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/Tool.java b/sonar-core/src/main/java/org/sonar/core/sarif/Tool.java
deleted file mode 100644
index df6626f1fdf..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/Tool.java
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-import java.util.Set;
-
-public class Tool {
-  @SerializedName("driver")
-  private final Driver driver;
-  @SerializedName("extensions")
-  private Set<Extension> extensions;
-
-  public Tool(Driver driver) {
-    this.driver = driver;
-  }
-
-  public Driver getDriver() {
-    return driver;
-  }
-
-  public Set<Extension> getExtensions() {
-    return extensions;
-  }
-}
diff --git a/sonar-core/src/main/java/org/sonar/core/sarif/WrappedText.java b/sonar-core/src/main/java/org/sonar/core/sarif/WrappedText.java
deleted file mode 100644
index 3dbdb823302..00000000000
--- a/sonar-core/src/main/java/org/sonar/core/sarif/WrappedText.java
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.google.gson.annotations.SerializedName;
-import java.util.Objects;
-
-public class WrappedText {
-  @SerializedName("text")
-  private final String text;
-
-  private WrappedText(String textToWrap) {
-    this.text = textToWrap;
-  }
-
-  public static WrappedText of(String textToWrap) {
-    return new WrappedText(textToWrap);
-  }
-
-  public String getText() {
-    return text;
-  }
-
-  @Override
-  public boolean equals(Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    WrappedText that = (WrappedText) o;
-    return Objects.equals(text, that.text);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(text);
-  }
-}
diff --git a/sonar-core/src/test/java/org/sonar/core/sarif/RuleTest.java b/sonar-core/src/test/java/org/sonar/core/sarif/RuleTest.java
deleted file mode 100644
index c446697d5fb..00000000000
--- a/sonar-core/src/test/java/org/sonar/core/sarif/RuleTest.java
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import java.util.Set;
-import org.junit.Test;
-
-import static org.apache.commons.lang3.RandomStringUtils.randomAlphanumeric;
-import static org.assertj.core.api.Assertions.assertThat;
-
-
-public class RuleTest {
-
-  @Test
-  public void equals_matchOnlyOnId() {
-    Rule rule1 = createRule();
-    Rule rule1Bis = createRule(rule1.getId()) ;
-    Rule rule2 = withRuleId(rule1, rule1.getId() + randomAlphanumeric(3));
-
-    assertThat(rule1).isEqualTo(rule1Bis).isNotEqualTo(rule2);
-  }
-
-  @Test
-  public void equals_notMatchWithNull(){
-    Rule rule1 = createRule();
-
-    assertThat(rule1).isNotEqualTo(null);
-  }
-
-  @Test
-  public void equals_matchWithSameObject(){
-    Rule rule1 = createRule();
-
-    assertThat(rule1).isEqualTo(rule1);
-  }
-
-  private static Rule withRuleId(Rule rule, String id) {
-    return Rule.builder()
-      .id(id)
-      .name(rule.getName())
-      .shortDescription(rule.getName())
-      .fullDescription(rule.getName())
-      .help(rule.getFullDescription().getText())
-      .properties(rule.getProperties())
-      .build();
-  }
-
-  private static Rule createRule() {
-    return createRule(randomAlphanumeric(5));
-  }
-
-  private static Rule createRule(String id) {
-    return Rule.builder()
-      .id(id)
-      .name(randomAlphanumeric(5))
-      .shortDescription(randomAlphanumeric(5))
-      .fullDescription(randomAlphanumeric(10))
-      .help(randomAlphanumeric(10))
-      .properties(PropertiesBag.of(randomAlphanumeric(3), Set.of(randomAlphanumeric(4))))
-      .build();
-  }
-
-}
diff --git a/sonar-core/src/test/java/org/sonar/core/sarif/Sarif210SerializationDeserializationTest.java b/sonar-core/src/test/java/org/sonar/core/sarif/Sarif210SerializationDeserializationTest.java
index 757ba2ca8e1..f4b2b0bc99f 100644
--- a/sonar-core/src/test/java/org/sonar/core/sarif/Sarif210SerializationDeserializationTest.java
+++ b/sonar-core/src/test/java/org/sonar/core/sarif/Sarif210SerializationDeserializationTest.java
@@ -19,13 +19,14 @@
  */
 package org.sonar.core.sarif;
 
+import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import org.apache.commons.io.IOUtils;
 import org.junit.Test;
-import org.sonar.core.sarif.Sarif210;
+import org.sonar.sarif.pojo.SarifSchema210;
 import org.sonar.test.JsonAssert;
 
 import static java.util.Objects.requireNonNull;
@@ -36,11 +37,9 @@ public class Sarif210SerializationDeserializationTest {
 
   @Test
   public void verify_json_serialization_of_sarif210() throws IOException {
-    Gson gson = new GsonBuilder().setPrettyPrinting().create();
-
     String expectedJson = IOUtils.toString(requireNonNull(getClass().getResource(VALID_SARIF_210_FILE_JSON)), StandardCharsets.UTF_8);
-    Sarif210 deserializedJson = gson.fromJson(expectedJson, Sarif210.class);
-    String reserializedJson = gson.toJson(deserializedJson);
+    SarifSchema210 deserializedJson = new ObjectMapper().readValue(expectedJson, SarifSchema210.class);
+    String reserializedJson = new ObjectMapper().writerWithDefaultPrettyPrinter().writeValueAsString(deserializedJson);
 
     JsonAssert.assertJson(reserializedJson).isSimilarTo(expectedJson);
   }
diff --git a/sonar-core/src/test/java/org/sonar/core/sarif/SarifSerializerImplTest.java b/sonar-core/src/test/java/org/sonar/core/sarif/SarifSerializerImplTest.java
index 9c3cb47d1c4..ed8e78ef1ef 100644
--- a/sonar-core/src/test/java/org/sonar/core/sarif/SarifSerializerImplTest.java
+++ b/sonar-core/src/test/java/org/sonar/core/sarif/SarifSerializerImplTest.java
@@ -19,22 +19,36 @@
  */
 package org.sonar.core.sarif;
 
+import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
-import java.nio.file.NoSuchFileException;
 import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.util.List;
 import java.util.Set;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.junit.MockitoJUnitRunner;
+import org.sonar.sarif.pojo.ArtifactLocation;
+import org.sonar.sarif.pojo.Location;
+import org.sonar.sarif.pojo.Message;
+import org.sonar.sarif.pojo.MultiformatMessageString;
+import org.sonar.sarif.pojo.PhysicalLocation;
+import org.sonar.sarif.pojo.Region;
+import org.sonar.sarif.pojo.ReportingDescriptor;
+import org.sonar.sarif.pojo.Result;
+import org.sonar.sarif.pojo.Run;
+import org.sonar.sarif.pojo.SarifSchema210;
+import org.sonar.sarif.pojo.Tool;
+import org.sonar.sarif.pojo.ToolComponent;
+import org.sonar.test.JsonAssert;
 
 import static java.lang.String.format;
 import static java.util.Objects.requireNonNull;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.assertj.core.api.Assertions.fail;
-import static org.sonar.core.sarif.SarifVersionValidator.UNSUPPORTED_VERSION_MESSAGE_TEMPLATE;
+import static org.sonar.core.sarif.SarifSerializerImpl.UNSUPPORTED_VERSION_MESSAGE_TEMPLATE;
 
 @RunWith(MockitoJUnitRunner.class)
 public class SarifSerializerImplTest {
@@ -45,20 +59,23 @@ public class SarifSerializerImplTest {
 
   @Test
   public void serialize() {
-    Run.builder().results(Set.of()).build();
-    Sarif210 sarif210 = new Sarif210("http://json.schemastore.org/sarif-2.1.0-rtm.4", Run.builder().results(Set.of()).build());
+    new Run().withResults(List.of());
+    SarifSchema210 sarif210 = new SarifSchema210()
+      .with$schema(URI.create("http://json.schemastore.org/sarif-2.1.0-rtm.4"))
+      .withVersion(SarifSchema210.Version._2_1_0)
+      .withRuns(List.of(new Run().withResults(List.of())));
 
     String result = serializer.serialize(sarif210);
 
-    assertThat(result).isEqualTo(SARIF_JSON);
+    JsonAssert.assertJson(result).isSimilarTo(SARIF_JSON);
   }
 
   @Test
-  public void deserialize() throws URISyntaxException, NoSuchFileException {
+  public void deserialize() throws URISyntaxException {
     URL sarifResource = requireNonNull(getClass().getResource("eslint-sarif210.json"));
     Path sarif = Paths.get(sarifResource.toURI());
 
-    Sarif210 deserializationResult = serializer.deserialize(sarif);
+    SarifSchema210 deserializationResult = serializer.deserialize(sarif);
 
     verifySarif(deserializationResult);
   }
@@ -69,7 +86,8 @@ public class SarifSerializerImplTest {
     Path sarif = Paths.get(file);
 
     assertThatThrownBy(() -> serializer.deserialize(sarif))
-      .isInstanceOf(NoSuchFileException.class);
+      .isInstanceOf(IllegalStateException.class)
+      .hasMessage("Failed to read SARIF report at 'wrongPathToFile'");
   }
 
   @Test
@@ -102,73 +120,72 @@ public class SarifSerializerImplTest {
       .hasMessage(format(UNSUPPORTED_VERSION_MESSAGE_TEMPLATE, "A.B.C"));
   }
 
-  private void verifySarif(Sarif210 deserializationResult) {
-    Sarif210 expected = buildExpectedSarif210();
+  private void verifySarif(SarifSchema210 deserializationResult) {
+    SarifSchema210 expected = buildExpectedSarif210();
 
     assertThat(deserializationResult).isNotNull();
     assertThat(deserializationResult).usingRecursiveComparison().ignoringFields("runs").isEqualTo(expected);
 
     Run run = getRun(deserializationResult);
     Run expectedRun = getRun(expected);
-    assertThat(run).usingRecursiveComparison().ignoringFields("results", "tool.driver.rules").isEqualTo(expectedRun);
+    assertThat(run).usingRecursiveComparison().ignoringFields("results", "tool.driver.rules", "tool.driver.informationUri", "artifacts").isEqualTo(expectedRun);
 
     Result result = getResult(run);
     Result expectedResult = getResult(expectedRun);
     assertThat(result).usingRecursiveComparison().isEqualTo(expectedResult);
 
-    Rule rule = getRule(run);
-    Rule expectedRule = getRule(expectedRun);
+    ReportingDescriptor rule = getRule(run);
+    ReportingDescriptor expectedRule = getRule(expectedRun);
     assertThat(rule).usingRecursiveComparison().ignoringFields("properties").isEqualTo(expectedRule);
   }
 
-  private static Sarif210 buildExpectedSarif210() {
-    return new Sarif210("http://json.schemastore.org/sarif-2.1.0-rtm.4", buildExpectedRun());
+  private static SarifSchema210 buildExpectedSarif210() {
+    return new SarifSchema210()
+      .with$schema(URI.create("http://json.schemastore.org/sarif-2.1.0-rtm.4"))
+      .withVersion(SarifSchema210.Version._2_1_0)
+      .withRuns(List.of(buildExpectedRun()));
   }
 
   private static Run buildExpectedRun() {
-    Tool tool = new Tool(buildExpectedDriver());
-    return Run.builder()
-      .tool(tool)
-      .results(Set.of(buildExpectedResult())).build();
+    Tool tool = new Tool().withDriver(buildExpectedDriver());
+    return new Run().withTool(tool).withResults(List.of(buildExpectedResult()));
   }
 
-  private static Driver buildExpectedDriver() {
-    return Driver.builder()
-      .name("ESLint")
-      .rules(Set.of(buildExpectedRule()))
-      .build();
+  private static ToolComponent buildExpectedDriver() {
+    return new ToolComponent()
+      .withName("ESLint")
+      .withRules(Set.of(buildExpectedRule()));
   }
 
-  private static Rule buildExpectedRule() {
-    return Rule.builder()
-      .id("no-unused-vars")
-      .shortDescription("disallow unused variables")
-      .build();
+  private static ReportingDescriptor buildExpectedRule() {
+    return new ReportingDescriptor()
+      .withId("no-unused-vars")
+      .withShortDescription(new MultiformatMessageString().withText("disallow unused variables"))
+      .withHelpUri(URI.create("https://eslint.org/docs/rules/no-unused-vars"));
   }
 
   private static Result buildExpectedResult() {
-    return Result.builder()
-      .ruleId("no-unused-vars")
-      .locations(Set.of(buildExpectedLocation()))
-      .message("'x' is assigned a value but never used.")
-      .level("error")
-      .build();
+    return new Result()
+      .withRuleId("no-unused-vars")
+      .withRuleIndex(0)
+      .withLocations(List.of(buildExpectedLocation()))
+      .withMessage(new Message().withText("'x' is assigned a value but never used."))
+      .withLevel(Result.Level.ERROR);
   }
 
   private static Location buildExpectedLocation() {
-    ArtifactLocation artifactLocation = new ArtifactLocation(null, "file:///C:/dev/sarif/sarif-tutorials/samples/Introduction/simple-example.js");
-    PhysicalLocation physicalLocation = PhysicalLocation.of(artifactLocation, buildExpectedRegion());
-    return Location.of(physicalLocation);
+    ArtifactLocation artifactLocation = new ArtifactLocation().withUri("file:///C:/dev/sarif/sarif-tutorials/samples/Introduction/simple-example.js").withIndex(0);
+    PhysicalLocation physicalLocation = new PhysicalLocation().withArtifactLocation(artifactLocation).withRegion(buildExpectedRegion());
+    return new Location().withPhysicalLocation(physicalLocation);
   }
 
   private static Region buildExpectedRegion() {
-    return Region.builder()
-      .startLine(1)
-      .startColumn(5)
-      .build();
+    return new Region()
+      .withStartLine(1)
+      .withStartColumn(5);
   }
 
-  private static Run getRun(Sarif210 sarif210) {
+  private static Run getRun(SarifSchema210 sarif210) {
     return sarif210.getRuns().stream().findFirst().orElseGet(() -> fail("runs property is missing"));
   }
 
@@ -176,7 +193,7 @@ public class SarifSerializerImplTest {
     return run.getResults().stream().findFirst().orElseGet(() -> fail("results property is missing"));
   }
 
-  private static Rule getRule(Run run) {
+  private static ReportingDescriptor getRule(Run run) {
     return run.getTool().getDriver().getRules().stream().findFirst().orElseGet(() -> fail("rules property is missing"));
   }
 
diff --git a/sonar-core/src/test/java/org/sonar/core/sarif/SarifVersionValidatorTest.java b/sonar-core/src/test/java/org/sonar/core/sarif/SarifVersionValidatorTest.java
deleted file mode 100644
index 11797d5ea93..00000000000
--- a/sonar-core/src/test/java/org/sonar/core/sarif/SarifVersionValidatorTest.java
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * SonarQube
- * Copyright (C) 2009-2024 SonarSource SA
- * mailto:info AT sonarsource DOT com
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- */
-package org.sonar.core.sarif;
-
-import com.tngtech.java.junit.dataprovider.DataProvider;
-import com.tngtech.java.junit.dataprovider.DataProviderRunner;
-import com.tngtech.java.junit.dataprovider.UseDataProvider;
-import java.util.List;
-import java.util.Set;
-import java.util.stream.Collectors;
-import java.util.stream.IntStream;
-import java.util.stream.Stream;
-import org.apache.commons.lang3.RandomStringUtils;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-
-import static java.lang.String.format;
-import static org.assertj.core.api.Assertions.assertThatCode;
-import static org.assertj.core.api.AssertionsForClassTypes.assertThatThrownBy;
-import static org.sonar.core.sarif.SarifVersionValidator.SUPPORTED_SARIF_VERSIONS;
-import static org.sonar.core.sarif.SarifVersionValidator.UNSUPPORTED_VERSION_MESSAGE_TEMPLATE;
-
-@RunWith(DataProviderRunner.class)
-public class SarifVersionValidatorTest {
-
-  @Test
-  @UseDataProvider("unsupportedSarifVersions")
-  public void sarif_version_validation_fails_if_version_is_not_supported(String version) {
-    assertThatThrownBy(() -> SarifVersionValidator.validateSarifVersion(version))
-      .isExactlyInstanceOf(IllegalStateException.class)
-      .hasMessage(format(UNSUPPORTED_VERSION_MESSAGE_TEMPLATE, version));
-  }
-
-  @Test
-  @UseDataProvider("supportedSarifVersions")
-  public void sarif_version_validation_succeeds_if_version_is_supported(String version) {
-    assertThatCode(() -> SarifVersionValidator.validateSarifVersion(version))
-      .doesNotThrowAnyException();
-  }
-
-  @DataProvider
-  public static List<String> unsupportedSarifVersions() {
-    List<String> unsupportedVersions = generateRandomUnsupportedSemanticVersions(10);
-    unsupportedVersions.add(null);
-    return unsupportedVersions;
-  }
-
-  @DataProvider
-  public static Set<String> supportedSarifVersions() {
-    return SUPPORTED_SARIF_VERSIONS;
-  }
-
-  private static List<String> generateRandomUnsupportedSemanticVersions(int amount) {
-    return Stream
-      .generate(SarifVersionValidatorTest::generateRandomSemanticVersion)
-      .takeWhile(SarifVersionValidatorTest::isUnsupportedVersion)
-      .limit(amount)
-      .collect(Collectors.toList());
- }
-
-  private static String generateRandomSemanticVersion() {
-    return IntStream
-      .rangeClosed(1, 3)
-      .mapToObj(x -> RandomStringUtils.randomNumeric(1))
-      .collect(Collectors.joining("."));
-  }
-
-  private static boolean isUnsupportedVersion(String version) {
-    return !SUPPORTED_SARIF_VERSIONS.contains(version);
-  }
-
-}
diff --git a/sonar-sarif/build.gradle b/sonar-sarif/build.gradle
new file mode 100644
index 00000000000..befefe045c3
--- /dev/null
+++ b/sonar-sarif/build.gradle
@@ -0,0 +1,21 @@
+plugins {
+  id "org.jsonschema2pojo" version "1.2.1"
+}
+
+dependencies {
+  api 'com.fasterxml.jackson.core:jackson-databind'
+  api 'com.google.code.findbugs:jsr305'
+}
+
+jsonSchema2Pojo {
+  source = files("${sourceSets.main.output.resourcesDir}/sarif")
+  generateBuilders = true
+  inclusionLevel = "NON_DEFAULT"
+  initializeCollections = false
+  targetPackage = 'org.sonar.sarif.pojo'
+  includeJsr305Annotations = true
+}
+
+license {
+  excludes(["org/sonar/sarif/pojo/**/*"])
+}
\ No newline at end of file
diff --git a/sonar-sarif/src/main/resources/sarif/sarif-schema-2.1.0.json b/sonar-sarif/src/main/resources/sarif/sarif-schema-2.1.0.json
new file mode 100644
index 00000000000..0f58372b548
--- /dev/null
+++ b/sonar-sarif/src/main/resources/sarif/sarif-schema-2.1.0.json
@@ -0,0 +1,3389 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "title": "Static Analysis Results Format (SARIF) Version 2.1.0 JSON Schema",
+  "id": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json",
+  "description": "Static Analysis Results Format (SARIF) Version 2.1.0 JSON Schema: a standard format for the output of static analysis tools.",
+  "additionalProperties": false,
+  "type": "object",
+  "properties": {
+
+    "$schema": {
+      "description": "The URI of the JSON schema corresponding to the version.",
+      "type": "string",
+      "format": "uri"
+    },
+
+    "version": {
+      "description": "The SARIF format version of this log file.",
+      "enum": [ "2.1.0" ],
+      "type": "string"
+    },
+
+    "runs": {
+      "description": "The set of runs contained in this log file.",
+      "type": [ "array", "null" ],
+      "minItems": 0,
+      "uniqueItems": false,
+      "items": {
+        "$ref": "#/definitions/run"
+      }
+    },
+
+    "inlineExternalProperties": {
+      "description": "References to external property files that share data between runs.",
+      "type": "array",
+      "minItems": 0,
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/definitions/externalProperties"
+      }
+    },
+
+    "properties": {
+      "description": "Key/value pairs that provide additional information about the log file.",
+      "$ref": "#/definitions/propertyBag"
+    }
+  },
+
+  "required": [ "version", "runs" ],
+
+  "definitions": {
+
+    "address": {
+      "description": "A physical or virtual address, or a range of addresses, in an 'addressable region' (memory or a binary file).",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "absoluteAddress": {
+          "description": "The address expressed as a byte offset from the start of the addressable region.",
+          "type": "integer",
+          "minimum": -1,
+          "default": -1
+
+        },
+
+        "relativeAddress": {
+          "description": "The address expressed as a byte offset from the absolute address of the top-most parent object.",
+          "type": "integer"
+
+        },
+
+        "length": {
+          "description": "The number of bytes in this range of addresses.",
+          "type": "integer"
+        },
+
+        "kind": {
+          "description": "An open-ended string that identifies the address kind. 'data', 'function', 'header','instruction', 'module', 'page', 'section', 'segment', 'stack', 'stackFrame', 'table' are well-known values.",
+          "type": "string"
+        },
+
+        "name": {
+          "description": "A name that is associated with the address, e.g., '.text'.",
+          "type": "string"
+        },
+
+        "fullyQualifiedName": {
+          "description": "A human-readable fully qualified name that is associated with the address.",
+          "type": "string"
+        },
+
+        "offsetFromParent": {
+          "description": "The byte offset of this address from the absolute or relative address of the parent object.",
+          "type": "integer"
+        },
+
+        "index": {
+          "description": "The index within run.addresses of the cached object for this address.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "parentIndex": {
+          "description": "The index within run.addresses of the parent object.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the address.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "artifact": {
+      "description": "A single artifact. In some cases, this artifact might be nested within another artifact.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "description": {
+          "description": "A short description of the artifact.",
+          "$ref": "#/definitions/message"
+        },
+
+        "location": {
+          "description": "The location of the artifact.",
+          "$ref": "#/definitions/artifactLocation"
+        },
+
+        "parentIndex": {
+          "description": "Identifies the index of the immediate parent of the artifact, if this artifact is nested.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "offset": {
+          "description": "The offset in bytes of the artifact within its containing artifact.",
+          "type": "integer",
+          "minimum": 0
+        },
+
+        "length": {
+          "description": "The length of the artifact in bytes.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "roles": {
+          "description": "The role or roles played by the artifact in the analysis.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "enum": [
+              "analysisTarget",
+              "attachment",
+              "responseFile",
+              "resultFile",
+              "standardStream",
+              "tracedFile",
+              "unmodified",
+              "modified",
+              "added",
+              "deleted",
+              "renamed",
+              "uncontrolled",
+              "driver",
+              "extension",
+              "translation",
+              "taxonomy",
+              "policy",
+              "referencedOnCommandLine",
+              "memoryContents",
+              "directory",
+              "userSpecifiedConfiguration",
+              "toolSpecifiedConfiguration",
+              "debugOutputFile"
+            ],
+            "type": "string"
+          }
+        },
+
+        "mimeType": {
+          "description": "The MIME type (RFC 2045) of the artifact.",
+          "type": "string",
+          "pattern": "[^/]+/.+"
+        },
+
+        "contents": {
+          "description": "The contents of the artifact.",
+          "$ref": "#/definitions/artifactContent"
+        },
+
+        "encoding": {
+          "description": "Specifies the encoding for an artifact object that refers to a text file.",
+          "type": "string"
+        },
+
+        "sourceLanguage": {
+          "description": "Specifies the source language for any artifact object that refers to a text file that contains source code.",
+          "type": "string"
+        },
+
+        "hashes": {
+          "description": "A dictionary, each of whose keys is the name of a hash function and each of whose values is the hashed value of the artifact produced by the specified hash function.",
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+
+        "lastModifiedTimeUtc": {
+          "description": "The Coordinated Universal Time (UTC) date and time at which the artifact was most recently modified. See \"Date/time properties\" in the SARIF spec for the required format.",
+          "type": "string",
+          "format": "date-time"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the artifact.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "artifactChange": {
+      "description": "A change to a single artifact.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "artifactLocation": {
+          "description": "The location of the artifact to change.",
+          "$ref": "#/definitions/artifactLocation"
+        },
+
+        "replacements": {
+          "description": "An array of replacement objects, each of which represents the replacement of a single region in a single artifact specified by 'artifactLocation'.",
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": false,
+          "items": {
+            "$ref": "#/definitions/replacement"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the change.",
+          "$ref": "#/definitions/propertyBag"
+        }
+
+      },
+
+      "required": [ "artifactLocation", "replacements" ]
+    },
+
+    "artifactContent": {
+      "description": "Represents the contents of an artifact.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "text": {
+          "description": "UTF-8-encoded content from a text artifact.",
+          "type": "string"
+        },
+
+        "binary": {
+          "description": "MIME Base64-encoded content from a binary artifact, or from a text artifact in its original encoding.",
+          "type": "string"
+        },
+
+        "rendered": {
+          "description": "An alternate rendered representation of the artifact (e.g., a decompiled representation of a binary region).",
+          "$ref": "#/definitions/multiformatMessageString"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the artifact content.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "artifactLocation": {
+      "description": "Specifies the location of an artifact.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "uri": {
+          "description": "A string containing a valid relative or absolute URI.",
+          "type": "string",
+          "format": "uri-reference"
+        },
+
+        "uriBaseId": {
+          "description": "A string which indirectly specifies the absolute URI with respect to which a relative URI in the \"uri\" property is interpreted.",
+          "type": "string"
+        },
+
+        "index": {
+          "description": "The index within the run artifacts array of the artifact object associated with the artifact location.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "description": {
+          "description": "A short description of the artifact location.",
+          "$ref": "#/definitions/message"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the artifact location.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "attachment": {
+      "description": "An artifact relevant to a result.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "description": {
+          "description": "A message describing the role played by the attachment.",
+          "$ref": "#/definitions/message"
+        },
+
+        "artifactLocation": {
+          "description": "The location of the attachment.",
+          "$ref": "#/definitions/artifactLocation"
+        },
+
+        "regions": {
+          "description": "An array of regions of interest within the attachment.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/region"
+          }
+        },
+
+        "rectangles": {
+          "description": "An array of rectangles specifying areas of interest within the image.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/rectangle"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the attachment.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+
+      "required": [ "artifactLocation" ]
+    },
+
+    "codeFlow": {
+      "description": "A set of threadFlows which together describe a pattern of code execution relevant to detecting a result.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "message": {
+          "description": "A message relevant to the code flow.",
+          "$ref": "#/definitions/message"
+        },
+
+        "threadFlows": {
+          "description": "An array of one or more unique threadFlow objects, each of which describes the progress of a program through a thread of execution.",
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": false,
+          "items": {
+            "$ref": "#/definitions/threadFlow"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the code flow.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+
+      "required": [ "threadFlows" ]
+    },
+
+    "configurationOverride": {
+      "description": "Information about how a specific rule or notification was reconfigured at runtime.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "configuration": {
+          "description": "Specifies how the rule or notification was configured during the scan.",
+          "$ref": "#/definitions/reportingConfiguration"
+        },
+
+        "descriptor": {
+          "description": "A reference used to locate the descriptor whose configuration was overridden.",
+          "$ref": "#/definitions/reportingDescriptorReference"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the configuration override.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+      "required": [ "configuration", "descriptor" ]
+    },
+
+    "conversion": {
+      "description": "Describes how a converter transformed the output of a static analysis tool from the analysis tool's native output format into the SARIF format.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "tool": {
+          "description": "A tool object that describes the converter.",
+          "$ref": "#/definitions/tool"
+        },
+
+        "invocation": {
+          "description": "An invocation object that describes the invocation of the converter.",
+          "$ref": "#/definitions/invocation"
+        },
+
+        "analysisToolLogFiles": {
+          "description": "The locations of the analysis tool's per-run log files.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/artifactLocation"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the conversion.",
+          "$ref": "#/definitions/propertyBag"
+        }
+
+      },
+
+      "required": [ "tool" ]
+    },
+
+    "edge": {
+      "description": "Represents a directed edge in a graph.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "id": {
+          "description": "A string that uniquely identifies the edge within its graph.",
+          "type": "string"
+        },
+
+        "label": {
+          "description": "A short description of the edge.",
+          "$ref": "#/definitions/message"
+        },
+
+        "sourceNodeId": {
+          "description": "Identifies the source node (the node at which the edge starts).",
+          "type": "string"
+        },
+
+        "targetNodeId": {
+          "description": "Identifies the target node (the node at which the edge ends).",
+          "type": "string"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the edge.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+
+      "required": [ "id", "sourceNodeId", "targetNodeId" ]
+    },
+
+    "edgeTraversal": {
+      "description": "Represents the traversal of a single edge during a graph traversal.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "edgeId": {
+          "description": "Identifies the edge being traversed.",
+          "type": "string"
+        },
+
+        "message": {
+          "description": "A message to display to the user as the edge is traversed.",
+          "$ref": "#/definitions/message"
+        },
+
+        "finalState": {
+          "description": "The values of relevant expressions after the edge has been traversed.",
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/multiformatMessageString"
+          }
+        },
+
+        "stepOverEdgeCount": {
+          "description": "The number of edge traversals necessary to return from a nested graph.",
+          "type": "integer",
+          "minimum": 0
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the edge traversal.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+
+      "required": [ "edgeId" ]
+    },
+
+    "exception": {
+      "description": "Describes a runtime exception encountered during the execution of an analysis tool.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "kind": {
+          "type": "string",
+          "description": "A string that identifies the kind of exception, for example, the fully qualified type name of an object that was thrown, or the symbolic name of a signal."
+        },
+
+        "message": {
+          "description": "A message that describes the exception.",
+          "type": "string"
+        },
+
+        "stack": {
+          "description": "The sequence of function calls leading to the exception.",
+          "$ref": "#/definitions/stack"
+        },
+
+        "innerExceptions": {
+          "description": "An array of exception objects each of which is considered a cause of this exception.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/exception"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the exception.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "externalProperties": {
+      "description": "The top-level element of an external property file.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "schema": {
+          "description": "The URI of the JSON schema corresponding to the version of the external property file format.",
+          "type": "string",
+          "format": "uri"
+        },
+
+        "version": {
+          "description": "The SARIF format version of this external properties object.",
+          "enum": [ "2.1.0" ],
+          "type": "string"
+        },
+
+        "guid": {
+          "description": "A stable, unique identifier for this external properties object, in the form of a GUID.",
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+
+        "runGuid": {
+          "description": "A stable, unique identifier for the run associated with this external properties object, in the form of a GUID.",
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+
+        "conversion": {
+          "description": "A conversion object that will be merged with a separate run.",
+          "$ref": "#/definitions/conversion"
+        },
+
+        "graphs": {
+          "description": "An array of graph objects that will be merged with a separate run.",
+          "type": "array",
+          "minItems": 0,
+          "default": [],
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/definitions/graph"
+          }
+        },
+
+        "externalizedProperties": {
+          "description": "Key/value pairs that provide additional information that will be merged with a separate run.",
+          "$ref": "#/definitions/propertyBag"
+        },
+
+        "artifacts": {
+          "description": "An array of artifact objects that will be merged with a separate run.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/definitions/artifact"
+          }
+        },
+
+        "invocations": {
+          "description": "Describes the invocation of the analysis tool that will be merged with a separate run.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/invocation"
+          }
+        },
+
+        "logicalLocations": {
+          "description": "An array of logical locations such as namespaces, types or functions that will be merged with a separate run.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/logicalLocation"
+          }
+        },
+
+        "threadFlowLocations": {
+          "description": "An array of threadFlowLocation objects that will be merged with a separate run.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/threadFlowLocation"
+          }
+        },
+
+        "results": {
+          "description": "An array of result objects that will be merged with a separate run.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/result"
+          }
+        },
+
+        "taxonomies": {
+          "description": "Tool taxonomies that will be merged with a separate run.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/toolComponent"
+          }
+        },
+
+        "driver": {
+          "description": "The analysis tool object that will be merged with a separate run.",
+          "$ref": "#/definitions/toolComponent"
+        },
+
+        "extensions": {
+          "description": "Tool extensions that will be merged with a separate run.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/toolComponent"
+          }
+        },
+
+        "policies": {
+          "description": "Tool policies that will be merged with a separate run.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/toolComponent"
+          }
+        },
+
+        "translations": {
+          "description": "Tool translations that will be merged with a separate run.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/toolComponent"
+          }
+        },
+
+        "addresses": {
+          "description": "Addresses that will be merged with a separate run.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/address"
+          }
+        },
+
+        "webRequests": {
+          "description": "Requests that will be merged with a separate run.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/webRequest"
+          }
+        },
+
+        "webResponses": {
+          "description": "Responses that will be merged with a separate run.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/webResponse"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the external properties.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "externalPropertyFileReference": {
+      "description": "Contains information that enables a SARIF consumer to locate the external property file that contains the value of an externalized property associated with the run.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "location": {
+          "description": "The location of the external property file.",
+          "$ref": "#/definitions/artifactLocation"
+        },
+
+        "guid": {
+          "description": "A stable, unique identifier for the external property file in the form of a GUID.",
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+
+        "itemCount": {
+          "description": "A non-negative integer specifying the number of items contained in the external property file.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the external property file.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+      "anyOf": [
+        { "required": [ "location" ] },
+        { "required": [ "guid" ] }
+      ]
+    },
+
+    "externalPropertyFileReferences": {
+      "description": "References to external property files that should be inlined with the content of a root log file.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "conversion": {
+          "description": "An external property file containing a run.conversion object to be merged with the root log file.",
+          "$ref": "#/definitions/externalPropertyFileReference"
+        },
+
+        "graphs": {
+          "description": "An array of external property files containing a run.graphs object to be merged with the root log file.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/externalPropertyFileReference"
+          }
+        },
+
+        "externalizedProperties": {
+          "description": "An external property file containing a run.properties object to be merged with the root log file.",
+          "$ref": "#/definitions/externalPropertyFileReference"
+        },
+
+        "artifacts": {
+          "description": "An array of external property files containing run.artifacts arrays to be merged with the root log file.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/externalPropertyFileReference"
+          }
+        },
+
+        "invocations": {
+          "description": "An array of external property files containing run.invocations arrays to be merged with the root log file.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/externalPropertyFileReference"
+          }
+        },
+
+        "logicalLocations": {
+          "description": "An array of external property files containing run.logicalLocations arrays to be merged with the root log file.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/externalPropertyFileReference"
+          }
+        },
+
+        "threadFlowLocations": {
+          "description": "An array of external property files containing run.threadFlowLocations arrays to be merged with the root log file.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/externalPropertyFileReference"
+          }
+        },
+
+        "results": {
+          "description": "An array of external property files containing run.results arrays to be merged with the root log file.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/externalPropertyFileReference"
+          }
+        },
+
+        "taxonomies": {
+          "description": "An array of external property files containing run.taxonomies arrays to be merged with the root log file.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/externalPropertyFileReference"
+          }
+        },
+
+        "addresses": {
+          "description": "An array of external property files containing run.addresses arrays to be merged with the root log file.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/externalPropertyFileReference"
+          }
+        },
+
+        "driver": {
+          "description": "An external property file containing a run.driver object to be merged with the root log file.",
+          "$ref": "#/definitions/externalPropertyFileReference"
+        },
+
+        "extensions": {
+          "description": "An array of external property files containing run.extensions arrays to be merged with the root log file.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/externalPropertyFileReference"
+          }
+        },
+
+        "policies": {
+          "description": "An array of external property files containing run.policies arrays to be merged with the root log file.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/externalPropertyFileReference"
+          }
+        },
+
+        "translations": {
+          "description": "An array of external property files containing run.translations arrays to be merged with the root log file.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/externalPropertyFileReference"
+          }
+        },
+
+        "webRequests": {
+          "description": "An array of external property files containing run.requests arrays to be merged with the root log file.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/externalPropertyFileReference"
+          }
+        },
+
+        "webResponses": {
+          "description": "An array of external property files containing run.responses arrays to be merged with the root log file.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/externalPropertyFileReference"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the external property files.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "fix": {
+      "description": "A proposed fix for the problem represented by a result object. A fix specifies a set of artifacts to modify. For each artifact, it specifies a set of bytes to remove, and provides a set of new bytes to replace them.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "description": {
+          "description": "A message that describes the proposed fix, enabling viewers to present the proposed change to an end user.",
+          "$ref": "#/definitions/message"
+        },
+
+        "artifactChanges": {
+          "description": "One or more artifact changes that comprise a fix for a result.",
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/definitions/artifactChange"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the fix.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+      "required": [ "artifactChanges" ]
+    },
+
+    "graph": {
+      "description": "A network of nodes and directed edges that describes some aspect of the structure of the code (for example, a call graph).",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "description": {
+          "description": "A description of the graph.",
+          "$ref": "#/definitions/message"
+        },
+
+        "nodes": {
+          "description": "An array of node objects representing the nodes of the graph.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/node"
+          }
+        },
+
+        "edges": {
+          "description": "An array of edge objects representing the edges of the graph.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/edge"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the graph.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "graphTraversal": {
+      "description": "Represents a path through a graph.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "runGraphIndex": {
+          "description": "The index within the run.graphs to be associated with the result.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "resultGraphIndex": {
+          "description": "The index within the result.graphs to be associated with the result.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "description": {
+          "description": "A description of this graph traversal.",
+          "$ref": "#/definitions/message"
+        },
+
+        "initialState": {
+          "description": "Values of relevant expressions at the start of the graph traversal that may change during graph traversal.",
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/multiformatMessageString"
+          }
+        },
+
+        "immutableState": {
+          "description": "Values of relevant expressions at the start of the graph traversal that remain constant for the graph traversal.",
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/multiformatMessageString"
+          }
+        },
+
+        "edgeTraversals": {
+          "description": "The sequences of edges traversed by this graph traversal.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/edgeTraversal"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the graph traversal.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+      "oneOf": [
+        { "required": [ "runGraphIndex" ] },
+        { "required": [ "resultGraphIndex" ] }
+      ]
+    },
+
+    "invocation": {
+      "description": "The runtime environment of the analysis tool run.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "commandLine": {
+          "description": "The command line used to invoke the tool.",
+          "type": "string"
+        },
+
+        "arguments": {
+          "description": "An array of strings, containing in order the command line arguments passed to the tool from the operating system.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "items": {
+            "type": "string"
+          }
+        },
+
+        "responseFiles": {
+          "description": "The locations of any response files specified on the tool's command line.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/definitions/artifactLocation"
+          }
+        },
+
+        "startTimeUtc": {
+          "description": "The Coordinated Universal Time (UTC) date and time at which the invocation started. See \"Date/time properties\" in the SARIF spec for the required format.",
+          "type": "string",
+          "format": "date-time"
+        },
+
+        "endTimeUtc": {
+          "description": "The Coordinated Universal Time (UTC) date and time at which the invocation ended. See \"Date/time properties\" in the SARIF spec for the required format.",
+          "type": "string",
+          "format": "date-time"
+        },
+
+        "exitCode": {
+          "description": "The process exit code.",
+          "type": "integer"
+        },
+
+        "ruleConfigurationOverrides": {
+          "description": "An array of configurationOverride objects that describe rules related runtime overrides.",
+          "type": "array",
+          "minItems": 0,
+          "default": [],
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/definitions/configurationOverride"
+          }
+        },
+
+        "notificationConfigurationOverrides": {
+          "description": "An array of configurationOverride objects that describe notifications related runtime overrides.",
+          "type": "array",
+          "minItems": 0,
+          "default": [],
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/definitions/configurationOverride"
+          }
+        },
+
+        "toolExecutionNotifications": {
+          "description": "A list of runtime conditions detected by the tool during the analysis.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/notification"
+          }
+        },
+
+        "toolConfigurationNotifications": {
+          "description": "A list of conditions detected by the tool that are relevant to the tool's configuration.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/notification"
+          }
+        },
+
+        "exitCodeDescription": {
+          "description": "The reason for the process exit.",
+          "type": "string"
+        },
+
+        "exitSignalName": {
+          "description": "The name of the signal that caused the process to exit.",
+          "type": "string"
+        },
+
+        "exitSignalNumber": {
+          "description": "The numeric value of the signal that caused the process to exit.",
+          "type": "integer"
+        },
+
+        "processStartFailureMessage": {
+          "description": "The reason given by the operating system that the process failed to start.",
+          "type": "string"
+        },
+
+        "executionSuccessful": {
+          "description": "Specifies whether the tool's execution completed successfully.",
+          "type": "boolean"
+        },
+
+        "machine": {
+          "description": "The machine on which the invocation occurred.",
+          "type": "string"
+        },
+
+        "account": {
+          "description": "The account under which the invocation occurred.",
+          "type": "string"
+        },
+
+        "processId": {
+          "description": "The id of the process in which the invocation occurred.",
+          "type": "integer"
+        },
+
+        "executableLocation": {
+          "description": "An absolute URI specifying the location of the executable that was invoked.",
+          "$ref": "#/definitions/artifactLocation"
+        },
+
+        "workingDirectory": {
+          "description": "The working directory for the invocation.",
+          "$ref": "#/definitions/artifactLocation"
+        },
+
+        "environmentVariables": {
+          "description": "The environment variables associated with the analysis tool process, expressed as key/value pairs.",
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+
+        "stdin": {
+          "description": "A file containing the standard input stream to the process that was invoked.",
+          "$ref": "#/definitions/artifactLocation"
+        },
+
+        "stdout": {
+          "description": "A file containing the standard output stream from the process that was invoked.",
+          "$ref": "#/definitions/artifactLocation"
+        },
+
+        "stderr": {
+          "description": "A file containing the standard error stream from the process that was invoked.",
+          "$ref": "#/definitions/artifactLocation"
+        },
+
+        "stdoutStderr": {
+          "description": "A file containing the interleaved standard output and standard error stream from the process that was invoked.",
+          "$ref": "#/definitions/artifactLocation"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the invocation.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+      "required": [ "executionSuccessful" ]
+    },
+
+    "location": {
+      "description": "A location within a programming artifact.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "id": {
+          "description": "Value that distinguishes this location from all other locations within a single result object.",
+          "type": "integer",
+          "minimum": -1,
+          "default": -1
+        },
+
+        "physicalLocation": {
+          "description": "Identifies the artifact and region.",
+          "$ref": "#/definitions/physicalLocation"
+        },
+
+        "logicalLocations": {
+          "description": "The logical locations associated with the result.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/logicalLocation"
+          }
+        },
+
+        "message": {
+          "description": "A message relevant to the location.",
+          "$ref": "#/definitions/message"
+        },
+
+        "annotations": {
+          "description": "A set of regions relevant to the location.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/region"
+          }
+        },
+
+        "relationships": {
+          "description": "An array of objects that describe relationships between this location and others.",
+          "type": "array",
+          "default": [],
+          "minItems": 0,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/definitions/locationRelationship"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the location.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "locationRelationship": {
+      "description": "Information about the relation of one location to another.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "target": {
+          "description": "A reference to the related location.",
+          "type": "integer",
+          "minimum": 0
+        },
+
+        "kinds": {
+          "description": "A set of distinct strings that categorize the relationship. Well-known kinds include 'includes', 'isIncludedBy' and 'relevant'.",
+          "type": "array",
+          "default": [ "relevant" ],
+          "uniqueItems": true,
+          "items": {
+            "type": "string"
+          }
+        },
+
+        "description": {
+          "description": "A description of the location relationship.",
+          "$ref": "#/definitions/message"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the location relationship.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+      "required": [ "target" ]
+    },
+
+    "logicalLocation": {
+      "description": "A logical location of a construct that produced a result.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "name": {
+          "description": "Identifies the construct in which the result occurred. For example, this property might contain the name of a class or a method.",
+          "type": "string"
+        },
+
+        "index": {
+          "description": "The index within the logical locations array.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "fullyQualifiedName": {
+          "description": "The human-readable fully qualified name of the logical location.",
+          "type": "string"
+        },
+
+        "decoratedName": {
+          "description": "The machine-readable name for the logical location, such as a mangled function name provided by a C++ compiler that encodes calling convention, return type and other details along with the function name.",
+          "type": "string"
+        },
+
+        "parentIndex": {
+          "description": "Identifies the index of the immediate parent of the construct in which the result was detected. For example, this property might point to a logical location that represents the namespace that holds a type.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "kind": {
+          "description": "The type of construct this logical location component refers to. Should be one of 'function', 'member', 'module', 'namespace', 'parameter', 'resource', 'returnType', 'type', 'variable', 'object', 'array', 'property', 'value', 'element', 'text', 'attribute', 'comment', 'declaration', 'dtd' or 'processingInstruction', if any of those accurately describe the construct.",
+          "type": "string"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the logical location.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "message": {
+      "description": "Encapsulates a message intended to be read by the end user.",
+      "type": "object",
+      "additionalProperties": false,
+
+      "properties": {
+
+        "text": {
+          "description": "A plain text message string.",
+          "type": "string"
+        },
+
+        "markdown": {
+          "description": "A Markdown message string.",
+          "type": "string"
+        },
+
+        "id": {
+          "description": "The identifier for this message.",
+          "type": "string"
+        },
+
+        "arguments": {
+          "description": "An array of strings to substitute into the message string.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "default": [],
+          "items": {
+            "type": "string"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the message.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+      "anyOf": [
+        { "required": [ "text" ] },
+        { "required": [ "id" ] }
+      ]
+    },
+
+    "multiformatMessageString": {
+      "description": "A message string or message format string rendered in multiple formats.",
+      "type": "object",
+      "additionalProperties": false,
+
+      "properties": {
+
+        "text": {
+          "description": "A plain text message string or format string.",
+          "type": "string"
+        },
+
+        "markdown": {
+          "description": "A Markdown message string or format string.",
+          "type": "string"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the message.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+      "required": [ "text" ]
+    },
+
+    "node": {
+      "description": "Represents a node in a graph.",
+      "type": "object",
+      "additionalProperties": false,
+
+      "properties": {
+
+        "id": {
+          "description": "A string that uniquely identifies the node within its graph.",
+          "type": "string"
+        },
+
+        "label": {
+          "description": "A short description of the node.",
+          "$ref": "#/definitions/message"
+        },
+
+        "location": {
+          "description": "A code location associated with the node.",
+          "$ref": "#/definitions/location"
+        },
+
+        "children": {
+          "description": "Array of child nodes.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/node"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the node.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+
+      "required": [ "id" ]
+    },
+
+    "notification": {
+      "description": "Describes a condition relevant to the tool itself, as opposed to being relevant to a target being analyzed by the tool.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "locations": {
+          "description": "The locations relevant to this notification.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/location"
+          }
+        },
+
+        "message": {
+          "description": "A message that describes the condition that was encountered.",
+          "$ref": "#/definitions/message"
+        },
+
+        "level": {
+          "description": "A value specifying the severity level of the notification.",
+          "default": "warning",
+          "enum": [ "none", "note", "warning", "error" ],
+          "type": "string"
+        },
+
+        "threadId": {
+          "description": "The thread identifier of the code that generated the notification.",
+          "type": "integer"
+        },
+
+        "timeUtc": {
+          "description": "The Coordinated Universal Time (UTC) date and time at which the analysis tool generated the notification.",
+          "type": "string",
+          "format": "date-time"
+        },
+
+        "exception": {
+          "description": "The runtime exception, if any, relevant to this notification.",
+          "$ref": "#/definitions/exception"
+        },
+
+        "descriptor": {
+          "description": "A reference used to locate the descriptor relevant to this notification.",
+          "$ref": "#/definitions/reportingDescriptorReference"
+        },
+
+        "associatedRule": {
+          "description": "A reference used to locate the rule descriptor associated with this notification.",
+          "$ref": "#/definitions/reportingDescriptorReference"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the notification.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+
+      "required": [ "message" ]
+    },
+
+    "physicalLocation": {
+      "description": "A physical location relevant to a result. Specifies a reference to a programming artifact together with a range of bytes or characters within that artifact.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "address": {
+          "description": "The address of the location.",
+          "$ref": "#/definitions/address"
+        },
+
+        "artifactLocation": {
+          "description": "The location of the artifact.",
+          "$ref": "#/definitions/artifactLocation"
+        },
+
+        "region": {
+          "description": "Specifies a portion of the artifact.",
+          "$ref": "#/definitions/region"
+        },
+
+        "contextRegion": {
+          "description": "Specifies a portion of the artifact that encloses the region. Allows a viewer to display additional context around the region.",
+          "$ref": "#/definitions/region"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the physical location.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+
+      "anyOf": [
+        {
+          "required": [ "address" ]
+        },
+        {
+          "required": [ "artifactLocation" ]
+        }
+      ]
+    },
+
+    "propertyBag": {
+      "description": "Key/value pairs that provide additional information about the object.",
+      "type": "object",
+      "additionalProperties": true,
+      "properties": {
+        "tags": {
+
+          "description": "A set of distinct strings that provide additional information.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+
+    "rectangle": {
+      "description": "An area within an image.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "top": {
+          "description": "The Y coordinate of the top edge of the rectangle, measured in the image's natural units.",
+          "type": "number"
+        },
+
+        "left": {
+          "description": "The X coordinate of the left edge of the rectangle, measured in the image's natural units.",
+          "type": "number"
+        },
+
+        "bottom": {
+          "description": "The Y coordinate of the bottom edge of the rectangle, measured in the image's natural units.",
+          "type": "number"
+        },
+
+        "right": {
+          "description": "The X coordinate of the right edge of the rectangle, measured in the image's natural units.",
+          "type": "number"
+        },
+
+        "message": {
+          "description": "A message relevant to the rectangle.",
+          "$ref": "#/definitions/message"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the rectangle.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "region": {
+      "description": "A region within an artifact where a result was detected.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "startLine": {
+          "description": "The line number of the first character in the region.",
+          "type": "integer",
+          "minimum": 1
+        },
+
+        "startColumn": {
+          "description": "The column number of the first character in the region.",
+          "type": "integer",
+          "minimum": 1
+        },
+
+        "endLine": {
+          "description": "The line number of the last character in the region.",
+          "type": "integer",
+          "minimum": 1
+        },
+
+        "endColumn": {
+          "description": "The column number of the character following the end of the region.",
+          "type": "integer",
+          "minimum": 1
+        },
+
+        "charOffset": {
+          "description": "The zero-based offset from the beginning of the artifact of the first character in the region.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "charLength": {
+          "description": "The length of the region in characters.",
+          "type": "integer",
+          "minimum": 0
+        },
+
+        "byteOffset": {
+          "description": "The zero-based offset from the beginning of the artifact of the first byte in the region.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "byteLength": {
+          "description": "The length of the region in bytes.",
+          "type": "integer",
+          "minimum": 0
+        },
+
+        "snippet": {
+          "description": "The portion of the artifact contents within the specified region.",
+          "$ref": "#/definitions/artifactContent"
+        },
+
+        "message": {
+          "description": "A message relevant to the region.",
+          "$ref": "#/definitions/message"
+        },
+
+        "sourceLanguage": {
+          "description": "Specifies the source language, if any, of the portion of the artifact specified by the region object.",
+          "type": "string"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the region.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+
+      "anyOf": [
+        { "required": [ "startLine" ] },
+        { "required": [ "charOffset" ] },
+        { "required": [ "byteOffset" ] }
+      ]
+    },
+
+    "replacement": {
+      "description": "The replacement of a single region of an artifact.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "deletedRegion": {
+          "description": "The region of the artifact to delete.",
+          "$ref": "#/definitions/region"
+        },
+
+        "insertedContent": {
+          "description": "The content to insert at the location specified by the 'deletedRegion' property.",
+          "$ref": "#/definitions/artifactContent"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the replacement.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+
+      "required": [ "deletedRegion" ]
+    },
+
+    "reportingDescriptor": {
+      "description": "Metadata that describes a specific report produced by the tool, as part of the analysis it provides or its runtime reporting.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "id": {
+          "description": "A stable, opaque identifier for the report.",
+          "type": "string"
+        },
+
+        "deprecatedIds": {
+          "description": "An array of stable, opaque identifiers by which this report was known in some previous version of the analysis tool.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "items": {
+            "type": "string"
+          }
+        },
+
+        "guid": {
+          "description": "A unique identifier for the reporting descriptor in the form of a GUID.",
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+
+        "deprecatedGuids": {
+          "description": "An array of unique identifies in the form of a GUID by which this report was known in some previous version of the analysis tool.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+          }
+        },
+
+        "name": {
+          "description": "A report identifier that is understandable to an end user.",
+          "type": "string"
+        },
+
+        "deprecatedNames": {
+          "description": "An array of readable identifiers by which this report was known in some previous version of the analysis tool.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "items": {
+            "type": "string"
+          }
+        },
+
+        "shortDescription": {
+          "description": "A concise description of the report. Should be a single sentence that is understandable when visible space is limited to a single line of text.",
+          "$ref": "#/definitions/multiformatMessageString"
+        },
+
+        "fullDescription": {
+          "description": "A description of the report. Should, as far as possible, provide details sufficient to enable resolution of any problem indicated by the result.",
+          "$ref": "#/definitions/multiformatMessageString"
+        },
+
+        "messageStrings": {
+          "description": "A set of name/value pairs with arbitrary names. Each value is a multiformatMessageString object, which holds message strings in plain text and (optionally) Markdown format. The strings can include placeholders, which can be used to construct a message in combination with an arbitrary number of additional string arguments.",
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/multiformatMessageString"
+          }
+        },
+
+        "defaultConfiguration": {
+          "description": "Default reporting configuration information.",
+          "$ref": "#/definitions/reportingConfiguration"
+        },
+
+        "helpUri": {
+          "description": "A URI where the primary documentation for the report can be found.",
+          "type": "string",
+          "format": "uri"
+        },
+
+        "help": {
+          "description": "Provides the primary documentation for the report, useful when there is no online documentation.",
+          "$ref": "#/definitions/multiformatMessageString"
+        },
+
+        "relationships": {
+          "description": "An array of objects that describe relationships between this reporting descriptor and others.",
+          "type": "array",
+          "default": [],
+          "minItems": 0,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/definitions/reportingDescriptorRelationship"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the report.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+      "required": [ "id" ]
+    },
+
+    "reportingConfiguration": {
+      "description": "Information about a rule or notification that can be configured at runtime.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "enabled": {
+          "description": "Specifies whether the report may be produced during the scan.",
+          "type": "boolean",
+          "default": true
+        },
+
+        "level": {
+          "description": "Specifies the failure level for the report.",
+          "default": "warning",
+          "enum": [ "none", "note", "warning", "error" ],
+          "type": "string"
+        },
+
+        "rank": {
+          "description": "Specifies the relative priority of the report. Used for analysis output only.",
+          "type": "number",
+          "default": -1.0,
+          "minimum": -1.0,
+          "maximum": 100.0
+        },
+
+        "parameters": {
+          "description": "Contains configuration information specific to a report.",
+          "$ref": "#/definitions/propertyBag"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the reporting configuration.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "reportingDescriptorReference": {
+      "description": "Information about how to locate a relevant reporting descriptor.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "id": {
+          "description": "The id of the descriptor.",
+          "type": "string"
+        },
+
+        "index": {
+          "description": "The index into an array of descriptors in toolComponent.ruleDescriptors, toolComponent.notificationDescriptors, or toolComponent.taxonomyDescriptors, depending on context.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "guid": {
+          "description": "A guid that uniquely identifies the descriptor.",
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+
+        "toolComponent": {
+          "description": "A reference used to locate the toolComponent associated with the descriptor.",
+          "$ref": "#/definitions/toolComponentReference"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the reporting descriptor reference.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+      "anyOf": [
+        { "required": [ "index" ] },
+        { "required": [ "guid" ] },
+        { "required": [ "id" ] }
+      ]
+    },
+
+    "reportingDescriptorRelationship": {
+      "description": "Information about the relation of one reporting descriptor to another.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "target": {
+          "description": "A reference to the related reporting descriptor.",
+          "$ref": "#/definitions/reportingDescriptorReference"
+        },
+
+        "kinds": {
+          "description": "A set of distinct strings that categorize the relationship. Well-known kinds include 'canPrecede', 'canFollow', 'willPrecede', 'willFollow', 'superset', 'subset', 'equal', 'disjoint', 'relevant', and 'incomparable'.",
+          "type": "array",
+          "default": [ "relevant" ],
+          "uniqueItems": true,
+          "items": {
+            "type": "string"
+          }
+        },
+
+        "description": {
+          "description": "A description of the reporting descriptor relationship.",
+          "$ref": "#/definitions/message"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the reporting descriptor reference.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+      "required": [ "target" ]
+    },
+
+    "result": {
+      "description": "A result produced by an analysis tool.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "ruleId": {
+          "description": "The stable, unique identifier of the rule, if any, to which this result is relevant.",
+          "type": "string"
+        },
+
+        "ruleIndex": {
+          "description": "The index within the tool component rules array of the rule object associated with this result.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "rule": {
+          "description": "A reference used to locate the rule descriptor relevant to this result.",
+          "$ref": "#/definitions/reportingDescriptorReference"
+        },
+
+        "kind": {
+          "description": "A value that categorizes results by evaluation state.",
+          "default": "fail",
+          "enum": [ "notApplicable", "pass", "fail", "review", "open", "informational" ],
+          "type": "string"
+        },
+
+        "level": {
+          "description": "A value specifying the severity level of the result.",
+          "default": "warning",
+          "enum": [ "none", "note", "warning", "error" ],
+          "type": "string"
+        },
+
+        "message": {
+          "description": "A message that describes the result. The first sentence of the message only will be displayed when visible space is limited.",
+          "$ref": "#/definitions/message"
+        },
+
+        "analysisTarget": {
+          "description": "Identifies the artifact that the analysis tool was instructed to scan. This need not be the same as the artifact where the result actually occurred.",
+          "$ref": "#/definitions/artifactLocation"
+        },
+
+        "locations": {
+          "description": "The set of locations where the result was detected. Specify only one location unless the problem indicated by the result can only be corrected by making a change at every specified location.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/location"
+          }
+        },
+
+        "guid": {
+          "description": "A stable, unique identifier for the result in the form of a GUID.",
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+
+        "correlationGuid": {
+          "description": "A stable, unique identifier for the equivalence class of logically identical results to which this result belongs, in the form of a GUID.",
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+
+        "occurrenceCount": {
+          "description": "A positive integer specifying the number of times this logically unique result was observed in this run.",
+          "type": "integer",
+          "minimum": 1
+        },
+
+        "partialFingerprints": {
+          "description": "A set of strings that contribute to the stable, unique identity of the result.",
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+
+        "fingerprints": {
+          "description": "A set of strings each of which individually defines a stable, unique identity for the result.",
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+
+        "stacks": {
+          "description": "An array of 'stack' objects relevant to the result.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/stack"
+          }
+        },
+
+        "codeFlows": {
+          "description": "An array of 'codeFlow' objects relevant to the result.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/codeFlow"
+          }
+        },
+
+        "graphs": {
+          "description": "An array of zero or more unique graph objects associated with the result.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/graph"
+          }
+        },
+
+        "graphTraversals": {
+          "description": "An array of one or more unique 'graphTraversal' objects.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/graphTraversal"
+          }
+        },
+
+        "relatedLocations": {
+          "description": "A set of locations relevant to this result.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/location"
+          }
+        },
+
+        "suppressions": {
+          "description": "A set of suppressions relevant to this result.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/definitions/suppression"
+          }
+        },
+
+        "baselineState": {
+          "description": "The state of a result relative to a baseline of a previous run.",
+          "enum": [
+            "new",
+            "unchanged",
+            "updated",
+            "absent"
+          ],
+          "type": "string"
+        },
+
+        "rank": {
+          "description": "A number representing the priority or importance of the result.",
+          "type": "number",
+          "default": -1.0,
+          "minimum": -1.0,
+          "maximum": 100.0
+        },
+
+        "attachments": {
+          "description": "A set of artifacts relevant to the result.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/attachment"
+          }
+        },
+
+        "hostedViewerUri": {
+          "description": "An absolute URI at which the result can be viewed.",
+          "type": "string",
+          "format": "uri"
+        },
+
+        "workItemUris": {
+          "description": "The URIs of the work items associated with this result.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "format": "uri"
+          }
+        },
+
+        "provenance": {
+          "description": "Information about how and when the result was detected.",
+          "$ref": "#/definitions/resultProvenance"
+        },
+
+        "fixes": {
+          "description": "An array of 'fix' objects, each of which represents a proposed fix to the problem indicated by the result.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/fix"
+          }
+        },
+
+        "taxa": {
+          "description": "An array of references to taxonomy reporting descriptors that are applicable to the result.",
+          "type": "array",
+          "default": [],
+          "minItems": 0,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/definitions/reportingDescriptorReference"
+          }
+        },
+
+        "webRequest": {
+          "description": "A web request associated with this result.",
+          "$ref": "#/definitions/webRequest"
+        },
+
+        "webResponse": {
+          "description": "A web response associated with this result.",
+          "$ref": "#/definitions/webResponse"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the result.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+      "required": [ "message" ]
+    },
+
+    "resultProvenance": {
+      "description": "Contains information about how and when a result was detected.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "firstDetectionTimeUtc": {
+          "description": "The Coordinated Universal Time (UTC) date and time at which the result was first detected. See \"Date/time properties\" in the SARIF spec for the required format.",
+          "type": "string",
+          "format": "date-time"
+        },
+
+        "lastDetectionTimeUtc": {
+          "description": "The Coordinated Universal Time (UTC) date and time at which the result was most recently detected. See \"Date/time properties\" in the SARIF spec for the required format.",
+          "type": "string",
+          "format": "date-time"
+        },
+
+        "firstDetectionRunGuid": {
+          "description": "A GUID-valued string equal to the automationDetails.guid property of the run in which the result was first detected.",
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+
+        "lastDetectionRunGuid": {
+          "description": "A GUID-valued string equal to the automationDetails.guid property of the run in which the result was most recently detected.",
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+
+        "invocationIndex": {
+          "description": "The index within the run.invocations array of the invocation object which describes the tool invocation that detected the result.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "conversionSources": {
+          "description": "An array of physicalLocation objects which specify the portions of an analysis tool's output that a converter transformed into the result.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/physicalLocation"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the result.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "run": {
+      "description": "Describes a single run of an analysis tool, and contains the reported output of that run.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "tool": {
+          "description": "Information about the tool or tool pipeline that generated the results in this run. A run can only contain results produced by a single tool or tool pipeline. A run can aggregate results from multiple log files, as long as context around the tool run (tool command-line arguments and the like) is identical for all aggregated files.",
+          "$ref": "#/definitions/tool"
+        },
+
+        "invocations": {
+          "description": "Describes the invocation of the analysis tool.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/invocation"
+          }
+        },
+
+        "conversion": {
+          "description": "A conversion object that describes how a converter transformed an analysis tool's native reporting format into the SARIF format.",
+          "$ref": "#/definitions/conversion"
+        },
+
+        "language": {
+          "description": "The language of the messages emitted into the log file during this run (expressed as an ISO 639-1 two-letter lowercase culture code) and an optional region (expressed as an ISO 3166-1 two-letter uppercase subculture code associated with a country or region). The casing is recommended but not required (in order for this data to conform to RFC5646).",
+          "type": "string",
+          "default": "en-US",
+          "pattern": "^[a-zA-Z]{2}(-[a-zA-Z]{2})?$"
+        },
+
+        "versionControlProvenance": {
+          "description": "Specifies the revision in version control of the artifacts that were scanned.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/versionControlDetails"
+          }
+        },
+
+        "originalUriBaseIds": {
+          "description": "The artifact location specified by each uriBaseId symbol on the machine where the tool originally ran.",
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/artifactLocation"
+          }
+        },
+
+        "artifacts": {
+          "description": "An array of artifact objects relevant to the run.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/definitions/artifact"
+          }
+        },
+
+        "logicalLocations": {
+          "description": "An array of logical locations such as namespaces, types or functions.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/logicalLocation"
+          }
+        },
+
+        "graphs": {
+          "description": "An array of zero or more unique graph objects associated with the run.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/graph"
+          }
+        },
+
+        "results": {
+          "description": "The set of results contained in an SARIF log. The results array can be omitted when a run is solely exporting rules metadata. It must be present (but may be empty) if a log file represents an actual scan.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "items": {
+            "$ref": "#/definitions/result"
+          }
+        },
+
+        "automationDetails": {
+          "description": "Automation details that describe this run.",
+          "$ref": "#/definitions/runAutomationDetails"
+        },
+
+        "runAggregates": {
+          "description": "Automation details that describe the aggregate of runs to which this run belongs.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/runAutomationDetails"
+          }
+        },
+
+        "baselineGuid": {
+          "description": "The 'guid' property of a previous SARIF 'run' that comprises the baseline that was used to compute result 'baselineState' properties for the run.",
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+
+        "redactionTokens": {
+          "description": "An array of strings used to replace sensitive information in a redaction-aware property.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "type": "string"
+          }
+        },
+
+        "defaultEncoding": {
+          "description": "Specifies the default encoding for any artifact object that refers to a text file.",
+          "type": "string"
+        },
+
+        "defaultSourceLanguage": {
+          "description": "Specifies the default source language for any artifact object that refers to a text file that contains source code.",
+          "type": "string"
+        },
+
+        "newlineSequences": {
+          "description": "An ordered list of character sequences that were treated as line breaks when computing region information for the run.",
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "default": [ "\r\n", "\n" ],
+          "items": {
+            "type": "string"
+          }
+        },
+
+        "columnKind": {
+          "description": "Specifies the unit in which the tool measures columns.",
+          "enum": [ "utf16CodeUnits", "unicodeCodePoints" ],
+          "type": "string"
+        },
+
+        "externalPropertyFileReferences": {
+          "description": "References to external property files that should be inlined with the content of a root log file.",
+          "$ref": "#/definitions/externalPropertyFileReferences"
+        },
+
+        "threadFlowLocations": {
+          "description": "An array of threadFlowLocation objects cached at run level.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/threadFlowLocation"
+          }
+        },
+
+        "taxonomies": {
+          "description": "An array of toolComponent objects relevant to a taxonomy in which results are categorized.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/toolComponent"
+          }
+        },
+
+        "addresses": {
+          "description": "Addresses associated with this run instance, if any.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/address"
+          }
+        },
+
+        "translations": {
+          "description": "The set of available translations of the localized data provided by the tool.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/toolComponent"
+          }
+        },
+
+        "policies": {
+          "description": "Contains configurations that may potentially override both reportingDescriptor.defaultConfiguration (the tool's default severities) and invocation.configurationOverrides (severities established at run-time from the command line).",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/toolComponent"
+          }
+        },
+
+        "webRequests": {
+          "description": "An array of request objects cached at run level.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/webRequest"
+          }
+        },
+
+        "webResponses": {
+          "description": "An array of response objects cached at run level.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/webResponse"
+          }
+        },
+
+        "specialLocations": {
+          "description": "A specialLocations object that defines locations of special significance to SARIF consumers.",
+          "$ref": "#/definitions/specialLocations"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the run.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+
+      "required": [ "tool" ]
+    },
+
+    "runAutomationDetails": {
+      "description": "Information that describes a run's identity and role within an engineering system process.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "description": {
+          "description": "A description of the identity and role played within the engineering system by this object's containing run object.",
+          "$ref": "#/definitions/message"
+        },
+
+        "id": {
+          "description": "A hierarchical string that uniquely identifies this object's containing run object.",
+          "type": "string"
+        },
+
+        "guid": {
+          "description": "A stable, unique identifier for this object's containing run object in the form of a GUID.",
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+
+        "correlationGuid": {
+          "description": "A stable, unique identifier for the equivalence class of runs to which this object's containing run object belongs in the form of a GUID.",
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the run automation details.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "specialLocations": {
+      "description": "Defines locations of special significance to SARIF consumers.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "displayBase": {
+          "description": "Provides a suggestion to SARIF consumers to display file paths relative to the specified location.",
+          "$ref": "#/definitions/artifactLocation"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the special locations.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "stack": {
+      "description": "A call stack that is relevant to a result.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "message": {
+          "description": "A message relevant to this call stack.",
+          "$ref": "#/definitions/message"
+        },
+
+        "frames": {
+          "description": "An array of stack frames that represents a sequence of calls, rendered in reverse chronological order, that comprise the call stack.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "items": {
+            "$ref": "#/definitions/stackFrame"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the stack.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+      "required": [ "frames" ]
+    },
+
+    "stackFrame": {
+      "description": "A function call within a stack trace.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "location": {
+          "description": "The location to which this stack frame refers.",
+          "$ref": "#/definitions/location"
+        },
+
+        "module": {
+          "description": "The name of the module that contains the code of this stack frame.",
+          "type": "string"
+        },
+
+        "threadId": {
+          "description": "The thread identifier of the stack frame.",
+          "type": "integer"
+        },
+
+        "parameters": {
+          "description": "The parameters of the call that is executing.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": false,
+          "default": [],
+          "items": {
+            "type": "string",
+            "default": []
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the stack frame.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "suppression": {
+      "description": "A suppression that is relevant to a result.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "guid": {
+          "description": "A stable, unique identifier for the suprression in the form of a GUID.",
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+
+        "kind": {
+          "description": "A string that indicates where the suppression is persisted.",
+          "enum": [
+            "inSource",
+            "external"
+          ],
+          "type": "string"
+        },
+
+        "status": {
+          "description": "A string that indicates the review status of the suppression.",
+          "enum": [
+            "accepted",
+            "underReview",
+            "rejected"
+          ],
+          "type": "string"
+        },
+
+        "justification": {
+          "description": "A string representing the justification for the suppression.",
+          "type": "string"
+        },
+
+        "location": {
+          "description": "Identifies the location associated with the suppression.",
+          "$ref": "#/definitions/location"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the suppression.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+      "required": [ "kind" ]
+    },
+
+    "threadFlow": {
+      "description": "Describes a sequence of code locations that specify a path through a single thread of execution such as an operating system or fiber.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "id": {
+          "description": "An string that uniquely identifies the threadFlow within the codeFlow in which it occurs.",
+          "type": "string"
+        },
+
+        "message": {
+          "description": "A message relevant to the thread flow.",
+          "$ref": "#/definitions/message"
+        },
+
+
+        "initialState": {
+          "description": "Values of relevant expressions at the start of the thread flow that may change during thread flow execution.",
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/multiformatMessageString"
+          }
+        },
+
+        "immutableState": {
+          "description": "Values of relevant expressions at the start of the thread flow that remain constant.",
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/multiformatMessageString"
+          }
+        },
+
+        "locations": {
+          "description": "A temporally ordered array of 'threadFlowLocation' objects, each of which describes a location visited by the tool while producing the result.",
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": false,
+          "items": {
+            "$ref": "#/definitions/threadFlowLocation"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the thread flow.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+
+      "required": [ "locations" ]
+    },
+
+    "threadFlowLocation": {
+      "description": "A location visited by an analysis tool while simulating or monitoring the execution of a program.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "index": {
+          "description": "The index within the run threadFlowLocations array.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "location": {
+          "description": "The code location.",
+          "$ref": "#/definitions/location"
+        },
+
+        "stack": {
+          "description": "The call stack leading to this location.",
+          "$ref": "#/definitions/stack"
+        },
+
+        "kinds": {
+          "description": "A set of distinct strings that categorize the thread flow location. Well-known kinds include 'acquire', 'release', 'enter', 'exit', 'call', 'return', 'branch', 'implicit', 'false', 'true', 'caution', 'danger', 'unknown', 'unreachable', 'taint', 'function', 'handler', 'lock', 'memory', 'resource', 'scope' and 'value'.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "type": "string"
+          }
+        },
+
+        "taxa": {
+          "description": "An array of references to rule or taxonomy reporting descriptors that are applicable to the thread flow location.",
+          "type": "array",
+          "default": [],
+          "minItems": 0,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/definitions/reportingDescriptorReference"
+          }
+        },
+
+        "module": {
+          "description": "The name of the module that contains the code that is executing.",
+          "type": "string"
+        },
+
+        "state": {
+          "description": "A dictionary, each of whose keys specifies a variable or expression, the associated value of which represents the variable or expression value. For an annotation of kind 'continuation', for example, this dictionary might hold the current assumed values of a set of global variables.",
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/multiformatMessageString"
+          }
+        },
+
+        "nestingLevel": {
+          "description": "An integer representing a containment hierarchy within the thread flow.",
+          "type": "integer",
+          "minimum": 0
+        },
+
+        "executionOrder": {
+          "description": "An integer representing the temporal order in which execution reached this location.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "executionTimeUtc": {
+          "description": "The Coordinated Universal Time (UTC) date and time at which this location was executed.",
+          "type": "string",
+          "format": "date-time"
+        },
+
+        "importance": {
+          "description": "Specifies the importance of this location in understanding the code flow in which it occurs. The order from most to least important is \"essential\", \"important\", \"unimportant\". Default: \"important\".",
+          "enum": [ "important", "essential", "unimportant" ],
+          "default": "important",
+          "type": "string"
+        },
+
+        "webRequest": {
+          "description": "A web request associated with this thread flow location.",
+          "$ref": "#/definitions/webRequest"
+        },
+
+        "webResponse": {
+          "description": "A web response associated with this thread flow location.",
+          "$ref": "#/definitions/webResponse"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the threadflow location.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "tool": {
+      "description": "The analysis tool that was run.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "driver": {
+          "description": "The analysis tool that was run.",
+          "$ref": "#/definitions/toolComponent"
+        },
+
+        "extensions": {
+          "description": "Tool extensions that contributed to or reconfigured the analysis tool that was run.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/toolComponent"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the tool.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+
+      "required": [ "driver" ]
+    },
+
+    "toolComponent": {
+      "description": "A component, such as a plug-in or the driver, of the analysis tool that was run.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+
+        "guid": {
+          "description": "A unique identifier for the tool component in the form of a GUID.",
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+
+        "name": {
+          "description": "The name of the tool component.",
+          "type": "string"
+        },
+
+        "organization": {
+          "description": "The organization or company that produced the tool component.",
+          "type": "string"
+        },
+
+        "product": {
+          "description": "A product suite to which the tool component belongs.",
+          "type": "string"
+        },
+
+        "productSuite": {
+          "description": "A localizable string containing the name of the suite of products to which the tool component belongs.",
+          "type": "string"
+        },
+
+        "shortDescription": {
+          "description": "A brief description of the tool component.",
+          "$ref": "#/definitions/multiformatMessageString"
+        },
+
+        "fullDescription": {
+          "description": "A comprehensive description of the tool component.",
+          "$ref": "#/definitions/multiformatMessageString"
+        },
+
+        "fullName": {
+          "description": "The name of the tool component along with its version and any other useful identifying information, such as its locale.",
+          "type": "string"
+        },
+
+        "version": {
+          "description": "The tool component version, in whatever format the component natively provides.",
+          "type": "string"
+        },
+
+        "semanticVersion": {
+          "description": "The tool component version in the format specified by Semantic Versioning 2.0.",
+          "type": "string"
+        },
+
+        "dottedQuadFileVersion": {
+          "description": "The binary version of the tool component's primary executable file expressed as four non-negative integers separated by a period (for operating systems that express file versions in this way).",
+          "type": "string",
+          "pattern": "[0-9]+(\\.[0-9]+){3}"
+        },
+
+        "releaseDateUtc": {
+          "description": "A string specifying the UTC date (and optionally, the time) of the component's release.",
+          "type": "string"
+        },
+
+        "downloadUri": {
+          "description": "The absolute URI from which the tool component can be downloaded.",
+          "type": "string",
+          "format": "uri"
+        },
+
+        "informationUri": {
+          "description": "The absolute URI at which information about this version of the tool component can be found.",
+          "type": "string",
+          "format": "uri"
+        },
+
+        "globalMessageStrings": {
+          "description": "A dictionary, each of whose keys is a resource identifier and each of whose values is a multiformatMessageString object, which holds message strings in plain text and (optionally) Markdown format. The strings can include placeholders, which can be used to construct a message in combination with an arbitrary number of additional string arguments.",
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/multiformatMessageString"
+          }
+        },
+
+        "notifications": {
+          "description": "An array of reportingDescriptor objects relevant to the notifications related to the configuration and runtime execution of the tool component.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/reportingDescriptor"
+          }
+        },
+
+        "rules": {
+          "description": "An array of reportingDescriptor objects relevant to the analysis performed by the tool component.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/reportingDescriptor"
+          }
+        },
+
+        "taxa": {
+          "description": "An array of reportingDescriptor objects relevant to the definitions of both standalone and tool-defined taxonomies.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/reportingDescriptor"
+          }
+        },
+
+        "locations": {
+          "description": "An array of the artifactLocation objects associated with the tool component.",
+          "type": "array",
+          "minItems": 0,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/artifactLocation"
+          }
+        },
+
+        "language": {
+          "description": "The language of the messages emitted into the log file during this run (expressed as an ISO 639-1 two-letter lowercase language code) and an optional region (expressed as an ISO 3166-1 two-letter uppercase subculture code associated with a country or region). The casing is recommended but not required (in order for this data to conform to RFC5646).",
+          "type": "string",
+          "default": "en-US",
+          "pattern": "^[a-zA-Z]{2}(-[a-zA-Z]{2})?$"
+        },
+
+        "contents": {
+          "description": "The kinds of data contained in this object.",
+          "type": "array",
+          "uniqueItems": true,
+          "default": [ "localizedData", "nonLocalizedData" ],
+          "items": {
+            "enum": [
+              "localizedData",
+              "nonLocalizedData"
+            ],
+            "type": "string"
+          }
+        },
+
+        "isComprehensive": {
+          "description": "Specifies whether this object contains a complete definition of the localizable and/or non-localizable data for this component, as opposed to including only data that is relevant to the results persisted to this log file.",
+          "type": "boolean",
+          "default": false
+        },
+
+        "localizedDataSemanticVersion": {
+          "description": "The semantic version of the localized strings defined in this component; maintained by components that provide translations.",
+          "type": "string"
+        },
+
+        "minimumRequiredLocalizedDataSemanticVersion": {
+          "description": "The minimum value of localizedDataSemanticVersion required in translations consumed by this component; used by components that consume translations.",
+          "type": "string"
+        },
+
+        "associatedComponent": {
+          "description": "The component which is strongly associated with this component. For a translation, this refers to the component which has been translated. For an extension, this is the driver that provides the extension's plugin model.",
+          "$ref": "#/definitions/toolComponentReference"
+        },
+
+        "translationMetadata": {
+          "description": "Translation metadata, required for a translation, not populated by other component types.",
+          "$ref": "#/definitions/translationMetadata"
+        },
+
+        "supportedTaxonomies": {
+          "description": "An array of toolComponentReference objects to declare the taxonomies supported by the tool component.",
+          "type": "array",
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/toolComponentReference"
+          }
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the tool component.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+
+      "required": [ "name" ]
+    },
+
+    "toolComponentReference": {
+      "description": "Identifies a particular toolComponent object, either the driver or an extension.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "name": {
+          "description": "The 'name' property of the referenced toolComponent.",
+          "type": "string"
+        },
+
+        "index": {
+          "description": "An index into the referenced toolComponent in tool.extensions.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "guid": {
+          "description": "The 'guid' property of the referenced toolComponent.",
+          "type": "string",
+          "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the toolComponentReference.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "translationMetadata": {
+      "description": "Provides additional metadata related to translation.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "name": {
+          "description": "The name associated with the translation metadata.",
+          "type": "string"
+        },
+
+        "fullName": {
+          "description": "The full name associated with the translation metadata.",
+          "type": "string"
+        },
+
+        "shortDescription": {
+          "description": "A brief description of the translation metadata.",
+          "$ref": "#/definitions/multiformatMessageString"
+        },
+
+        "fullDescription": {
+          "description": "A comprehensive description of the translation metadata.",
+          "$ref": "#/definitions/multiformatMessageString"
+        },
+
+        "downloadUri": {
+          "description": "The absolute URI from which the translation metadata can be downloaded.",
+          "type": "string",
+          "format": "uri"
+        },
+
+        "informationUri": {
+          "description": "The absolute URI from which information related to the translation metadata can be downloaded.",
+          "type": "string",
+          "format": "uri"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the translation metadata.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+      "required": [ "name" ]
+    },
+
+    "versionControlDetails": {
+      "description": "Specifies the information necessary to retrieve a desired revision from a version control system.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "repositoryUri": {
+          "description": "The absolute URI of the repository.",
+          "type": "string",
+          "format": "uri"
+        },
+
+        "revisionId": {
+          "description": "A string that uniquely and permanently identifies the revision within the repository.",
+          "type": "string"
+        },
+
+        "branch": {
+          "description": "The name of a branch containing the revision.",
+          "type": "string"
+        },
+
+        "revisionTag": {
+          "description": "A tag that has been applied to the revision.",
+          "type": "string"
+        },
+
+        "asOfTimeUtc": {
+          "description": "A Coordinated Universal Time (UTC) date and time that can be used to synchronize an enlistment to the state of the repository at that time.",
+          "type": "string",
+          "format": "date-time"
+        },
+
+        "mappedTo": {
+          "description": "The location in the local file system to which the root of the repository was mapped at the time of the analysis.",
+          "$ref": "#/definitions/artifactLocation"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the version control details.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      },
+
+      "required": [ "repositoryUri" ]
+    },
+
+    "webRequest": {
+      "description": "Describes an HTTP request.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "index": {
+          "description": "The index within the run.webRequests array of the request object associated with this result.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+
+        },
+
+        "protocol": {
+          "description": "The request protocol. Example: 'http'.",
+          "type": "string"
+        },
+
+        "version": {
+          "description": "The request version. Example: '1.1'.",
+          "type": "string"
+        },
+
+        "target": {
+          "description": "The target of the request.",
+          "type": "string"
+        },
+
+        "method": {
+          "description": "The HTTP method. Well-known values are 'GET', 'PUT', 'POST', 'DELETE', 'PATCH', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT'.",
+          "type": "string"
+        },
+
+        "headers": {
+          "description": "The request headers.",
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+
+        "parameters": {
+          "description": "The request parameters.",
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+
+        "body": {
+          "description": "The body of the request.",
+          "$ref": "#/definitions/artifactContent"
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the request.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    },
+
+    "webResponse": {
+      "description": "Describes the response to an HTTP request.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+
+        "index": {
+          "description": "The index within the run.webResponses array of the response object associated with this result.",
+          "type": "integer",
+          "default": -1,
+          "minimum": -1
+        },
+
+        "protocol": {
+          "description": "The response protocol. Example: 'http'.",
+          "type": "string"
+        },
+
+        "version": {
+          "description": "The response version. Example: '1.1'.",
+          "type": "string"
+        },
+
+        "statusCode": {
+          "description": "The response status code. Example: 451.",
+          "type": "integer"
+        },
+
+        "reasonPhrase": {
+          "description": "The response reason. Example: 'Not found'.",
+          "type": "string"
+        },
+
+        "headers": {
+          "description": "The response headers.",
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          }
+        },
+
+        "body": {
+          "description": "The body of the response.",
+          "$ref": "#/definitions/artifactContent"
+        },
+
+        "noResponseReceived": {
+          "description": "Specifies whether a response was received from the server.",
+          "type": "boolean",
+          "default": false
+        },
+
+        "properties": {
+          "description": "Key/value pairs that provide additional information about the response.",
+          "$ref": "#/definitions/propertyBag"
+        }
+      }
+    }
+  }
+}
diff --git a/sonar-scanner-engine/build.gradle b/sonar-scanner-engine/build.gradle
index 9963db68df4..121d7eec295 100644
--- a/sonar-scanner-engine/build.gradle
+++ b/sonar-scanner-engine/build.gradle
@@ -42,6 +42,7 @@ dependencies {
 
 
   api project(':sonar-core')
+  api project(':sonar-sarif')
   api project(':sonar-scanner-protocol')
   api project(':sonar-ws')
   api project(':sonar-duplications')
diff --git a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/DefaultSarif210Importer.java b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/DefaultSarif210Importer.java
index 8b4154ce197..cf70f351b6a 100644
--- a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/DefaultSarif210Importer.java
+++ b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/DefaultSarif210Importer.java
@@ -26,8 +26,8 @@ import org.slf4j.LoggerFactory;
 import org.sonar.api.batch.sensor.issue.NewExternalIssue;
 import org.sonar.api.batch.sensor.rule.NewAdHocRule;
 import org.sonar.api.scanner.ScannerSide;
-import org.sonar.core.sarif.Run;
-import org.sonar.core.sarif.Sarif210;
+import org.sonar.sarif.pojo.Run;
+import org.sonar.sarif.pojo.SarifSchema210;
 import org.sonar.scanner.externalissue.sarif.RunMapper.RunMapperResult;
 
 import static java.util.Objects.requireNonNull;
@@ -43,12 +43,12 @@ public class DefaultSarif210Importer implements Sarif210Importer {
   }
 
   @Override
-  public SarifImportResults importSarif(Sarif210 sarif210) {
+  public SarifImportResults importSarif(SarifSchema210 sarif210) {
     int successFullyImportedIssues = 0;
     int successFullyImportedRuns = 0;
     int failedRuns = 0;
 
-    Set<Run> runs = requireNonNull(sarif210.getRuns(), "The runs section of the Sarif report is null");
+    List<Run> runs = requireNonNull(sarif210.getRuns(), "The runs section of the Sarif report is null");
     for (Run run : runs) {
       RunMapperResult runMapperResult = tryMapRun(run);
       if (runMapperResult.isSuccess()) {
diff --git a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/LocationMapper.java b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/LocationMapper.java
index a3cb87de11d..df816a466d7 100644
--- a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/LocationMapper.java
+++ b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/LocationMapper.java
@@ -38,10 +38,10 @@ import org.sonar.api.batch.fs.internal.predicates.AbstractFilePredicate;
 import org.sonar.api.batch.sensor.SensorContext;
 import org.sonar.api.batch.sensor.issue.NewIssueLocation;
 import org.sonar.api.scanner.ScannerSide;
-import org.sonar.core.sarif.ArtifactLocation;
-import org.sonar.core.sarif.Location;
-import org.sonar.core.sarif.PhysicalLocation;
-import org.sonar.core.sarif.Result;
+import org.sonar.sarif.pojo.ArtifactLocation;
+import org.sonar.sarif.pojo.Location;
+import org.sonar.sarif.pojo.PhysicalLocation;
+import org.sonar.sarif.pojo.Result;
 
 import static java.util.Objects.requireNonNull;
 import static org.sonar.api.utils.Preconditions.checkArgument;
diff --git a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RegionMapper.java b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RegionMapper.java
index 48a1982c1da..076952c92d9 100644
--- a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RegionMapper.java
+++ b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RegionMapper.java
@@ -25,7 +25,7 @@ import javax.annotation.Nullable;
 import org.sonar.api.batch.fs.InputFile;
 import org.sonar.api.batch.fs.TextRange;
 import org.sonar.api.scanner.ScannerSide;
-import org.sonar.core.sarif.Region;
+import org.sonar.sarif.pojo.Region;
 
 @ScannerSide
 public class RegionMapper {
diff --git a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/ResultMapper.java b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/ResultMapper.java
index ae8790c2848..c81b1e33313 100644
--- a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/ResultMapper.java
+++ b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/ResultMapper.java
@@ -20,9 +20,9 @@
 package org.sonar.scanner.externalissue.sarif;
 
 import com.google.common.collect.ImmutableMap;
+import java.util.List;
 import java.util.Map;
 import java.util.Optional;
-import java.util.Set;
 import javax.annotation.Nullable;
 import org.sonar.api.batch.rule.Severity;
 import org.sonar.api.batch.sensor.SensorContext;
@@ -32,8 +32,8 @@ import org.sonar.api.issue.impact.SoftwareQuality;
 import org.sonar.api.rules.CleanCodeAttribute;
 import org.sonar.api.rules.RuleType;
 import org.sonar.api.scanner.ScannerSide;
-import org.sonar.core.sarif.Location;
-import org.sonar.core.sarif.Result;
+import org.sonar.sarif.pojo.Location;
+import org.sonar.sarif.pojo.Result;
 
 import static java.util.Objects.requireNonNull;
 import static org.sonar.api.issue.impact.Severity.HIGH;
@@ -45,18 +45,18 @@ import static org.sonar.api.rules.CleanCodeAttribute.CONVENTIONAL;
 @ScannerSide
 public class ResultMapper {
 
-  private static final Map<String, Severity> SEVERITY_MAPPING = ImmutableMap.<String, Severity>builder()
-    .put("error", Severity.CRITICAL)
-    .put("warning", Severity.MAJOR)
-    .put("note", Severity.MINOR)
-    .put("none", Severity.INFO)
+  private static final Map<Result.Level, Severity> SEVERITY_MAPPING = ImmutableMap.<Result.Level, Severity>builder()
+    .put(Result.Level.ERROR, Severity.CRITICAL)
+    .put(Result.Level.WARNING, Severity.MAJOR)
+    .put(Result.Level.NOTE, Severity.MINOR)
+    .put(Result.Level.NONE, Severity.INFO)
     .build();
 
-  private static final Map<String, org.sonar.api.issue.impact.Severity> IMPACT_SEVERITY_MAPPING = ImmutableMap.<String, org.sonar.api.issue.impact.Severity>builder()
-    .put("error", HIGH)
-    .put("warning", MEDIUM)
-    .put("note", LOW)
-    .put("none", LOW)
+  private static final Map<Result.Level, org.sonar.api.issue.impact.Severity> IMPACT_SEVERITY_MAPPING = ImmutableMap.<Result.Level, org.sonar.api.issue.impact.Severity>builder()
+    .put(Result.Level.ERROR, HIGH)
+    .put(Result.Level.WARNING, MEDIUM)
+    .put(Result.Level.NOTE, LOW)
+    .put(Result.Level.NONE, LOW)
     .build();
 
   public static final Severity DEFAULT_SEVERITY = Severity.MAJOR;
@@ -73,7 +73,7 @@ public class ResultMapper {
     this.locationMapper = locationMapper;
   }
 
-  NewExternalIssue mapResult(String driverName, @Nullable String ruleSeverity, @Nullable String ruleSeverityForNewTaxonomy, Result result) {
+  NewExternalIssue mapResult(String driverName, @Nullable Result.Level ruleSeverity, @Nullable Result.Level ruleSeverityForNewTaxonomy, Result result) {
     NewExternalIssue newExternalIssue = sensorContext.newExternalIssue();
     newExternalIssue.type(DEFAULT_TYPE);
     newExternalIssue.engineId(driverName);
@@ -86,17 +86,17 @@ public class ResultMapper {
     return newExternalIssue;
   }
 
-  protected static org.sonar.api.issue.impact.Severity toSonarQubeImpactSeverity(@Nullable String ruleSeverity) {
+  protected static org.sonar.api.issue.impact.Severity toSonarQubeImpactSeverity(@Nullable Result.Level ruleSeverity) {
     return IMPACT_SEVERITY_MAPPING.getOrDefault(ruleSeverity, DEFAULT_IMPACT_SEVERITY);
   }
 
-  protected static Severity toSonarQubeSeverity(@Nullable String ruleSeverity) {
+  protected static Severity toSonarQubeSeverity(@Nullable Result.Level ruleSeverity) {
     return SEVERITY_MAPPING.getOrDefault(ruleSeverity, DEFAULT_SEVERITY);
   }
 
   private void mapLocations(Result result, NewExternalIssue newExternalIssue) {
     NewIssueLocation newIssueLocation = newExternalIssue.newLocation();
-    Set<Location> locations = result.getLocations();
+    List<Location> locations = result.getLocations();
     if (locations == null || locations.isEmpty()) {
       newExternalIssue.at(locationMapper.fillIssueInProjectLocation(result, newIssueLocation));
     } else {
diff --git a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RuleMapper.java b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RuleMapper.java
index 71219332d4a..5638088fd11 100644
--- a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RuleMapper.java
+++ b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RuleMapper.java
@@ -23,7 +23,8 @@ import javax.annotation.Nullable;
 import org.sonar.api.batch.sensor.SensorContext;
 import org.sonar.api.batch.sensor.rule.NewAdHocRule;
 import org.sonar.api.scanner.ScannerSide;
-import org.sonar.core.sarif.Rule;
+import org.sonar.sarif.pojo.ReportingDescriptor;
+import org.sonar.sarif.pojo.Result;
 
 import static java.lang.String.join;
 
@@ -36,7 +37,7 @@ public class RuleMapper {
     this.sensorContext = sensorContext;
   }
 
-  NewAdHocRule mapRule(Rule rule, String driverName, @Nullable String ruleSeverity, @Nullable String ruleSeverityForNewTaxonomy) {
+  NewAdHocRule mapRule(ReportingDescriptor rule, String driverName, @Nullable Result.Level ruleSeverity, @Nullable Result.Level ruleSeverityForNewTaxonomy) {
     return sensorContext.newAdHocRule()
       .severity(ResultMapper.toSonarQubeSeverity(ruleSeverity))
       .type(ResultMapper.DEFAULT_TYPE)
diff --git a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RulesSeverityDetector.java b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RulesSeverityDetector.java
index 35183ccaa3b..d7223ae273f 100644
--- a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RulesSeverityDetector.java
+++ b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RulesSeverityDetector.java
@@ -28,12 +28,12 @@ import java.util.function.Predicate;
 import javax.annotation.Nullable;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.sonar.core.sarif.DefaultConfiguration;
-import org.sonar.core.sarif.Extension;
-import org.sonar.core.sarif.Result;
-import org.sonar.core.sarif.Rule;
-import org.sonar.core.sarif.Run;
-import org.sonar.core.sarif.Tool;
+import org.sonar.sarif.pojo.ReportingConfiguration;
+import org.sonar.sarif.pojo.ReportingDescriptor;
+import org.sonar.sarif.pojo.Result;
+import org.sonar.sarif.pojo.Run;
+import org.sonar.sarif.pojo.Tool;
+import org.sonar.sarif.pojo.ToolComponent;
 
 import static java.util.Collections.emptyMap;
 import static java.util.Collections.emptySet;
@@ -47,20 +47,20 @@ public class RulesSeverityDetector {
 
   private RulesSeverityDetector() {}
 
-  public static Map<String, String> detectRulesSeverities(Run run, String driverName) {
-    Map<String, String> resultDefinedRuleSeverities = getResultDefinedRuleSeverities(run);
+  public static Map<String, Result.Level> detectRulesSeverities(Run run, String driverName) {
+    Map<String, Result.Level> resultDefinedRuleSeverities = getResultDefinedRuleSeverities(run);
 
     if (!resultDefinedRuleSeverities.isEmpty()) {
       return resultDefinedRuleSeverities;
     }
 
-    Map<String, String> driverDefinedRuleSeverities = getDriverDefinedRuleSeverities(run);
+    Map<String, Result.Level> driverDefinedRuleSeverities = getDriverDefinedRuleSeverities(run);
 
     if (!driverDefinedRuleSeverities.isEmpty()) {
       return driverDefinedRuleSeverities;
     }
 
-    Map<String, String> extensionDefinedRuleSeverities = getExtensionsDefinedRuleSeverities(run);
+    Map<String, Result.Level> extensionDefinedRuleSeverities = getExtensionsDefinedRuleSeverities(run);
 
     if (!extensionDefinedRuleSeverities.isEmpty()) {
       return extensionDefinedRuleSeverities;
@@ -70,14 +70,14 @@ public class RulesSeverityDetector {
     return emptyMap();
   }
 
-  public static Map<String, String> detectRulesSeveritiesForNewTaxonomy(Run run, String driverName) {
-    Map<String, String> driverDefinedRuleSeverities = getDriverDefinedRuleSeverities(run);
+  public static Map<String, Result.Level> detectRulesSeveritiesForNewTaxonomy(Run run, String driverName) {
+    Map<String, Result.Level> driverDefinedRuleSeverities = getDriverDefinedRuleSeverities(run);
 
     if (!driverDefinedRuleSeverities.isEmpty()) {
       return driverDefinedRuleSeverities;
     }
 
-    Map<String, String> extensionDefinedRuleSeverities = getExtensionsDefinedRuleSeverities(run);
+    Map<String, Result.Level> extensionDefinedRuleSeverities = getExtensionsDefinedRuleSeverities(run);
 
     if (!extensionDefinedRuleSeverities.isEmpty()) {
       return extensionDefinedRuleSeverities;
@@ -87,7 +87,7 @@ public class RulesSeverityDetector {
     return emptyMap();
   }
 
-  private static Map<String, String> getResultDefinedRuleSeverities(Run run) {
+  private static Map<String, Result.Level> getResultDefinedRuleSeverities(Run run) {
     Predicate<Result> hasResultDefinedLevel = result -> Optional.ofNullable(result).map(Result::getLevel).isPresent();
 
     return run.getResults()
@@ -96,34 +96,34 @@ public class RulesSeverityDetector {
       .collect(toMap(Result::getRuleId, Result::getLevel, (x, y) -> y));
   }
 
-  private static Map<String, String> getDriverDefinedRuleSeverities(Run run) {
+  private static Map<String, Result.Level> getDriverDefinedRuleSeverities(Run run) {
     return run.getTool().getDriver().getRules()
       .stream()
       .filter(RulesSeverityDetector::hasRuleDefinedLevel)
-      .collect(toMap(Rule::getId, x -> x.getDefaultConfiguration().getLevel()));
+      .collect(toMap(ReportingDescriptor::getId, x -> Result.Level.valueOf(x.getDefaultConfiguration().getLevel().name())));
   }
 
-  private static Map<String, String> getExtensionsDefinedRuleSeverities(Run run) {
+  private static Map<String, Result.Level> getExtensionsDefinedRuleSeverities(Run run) {
     return getExtensions(run)
       .stream()
-      .map(Extension::getRules)
+      .map(ToolComponent::getRules)
       .filter(Objects::nonNull)
       .flatMap(Collection::stream)
       .filter(RulesSeverityDetector::hasRuleDefinedLevel)
-      .collect(toMap(Rule::getId, rule -> rule.getDefaultConfiguration().getLevel()));
+      .collect(toMap(ReportingDescriptor::getId, rule -> Result.Level.valueOf(rule.getDefaultConfiguration().getLevel().name())));
   }
 
-  private static Set<Extension> getExtensions(Run run) {
+  private static Set<ToolComponent> getExtensions(Run run) {
     return Optional.of(run)
       .map(Run::getTool)
       .map(Tool::getExtensions)
       .orElse(emptySet());
   }
 
-  private static boolean hasRuleDefinedLevel(@Nullable Rule rule) {
+  private static boolean hasRuleDefinedLevel(@Nullable ReportingDescriptor rule) {
     return Optional.ofNullable(rule)
-      .map(Rule::getDefaultConfiguration)
-      .map(DefaultConfiguration::getLevel)
+      .map(ReportingDescriptor::getDefaultConfiguration)
+      .map(ReportingConfiguration::getLevel)
       .isPresent();
   }
 
diff --git a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RunMapper.java b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RunMapper.java
index f94549c5ade..90787d379f2 100644
--- a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RunMapper.java
+++ b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/RunMapper.java
@@ -30,12 +30,11 @@ import org.slf4j.LoggerFactory;
 import org.sonar.api.batch.sensor.issue.NewExternalIssue;
 import org.sonar.api.batch.sensor.rule.NewAdHocRule;
 import org.sonar.api.scanner.ScannerSide;
-import org.sonar.core.sarif.Driver;
-import org.sonar.core.sarif.Extension;
-import org.sonar.core.sarif.Result;
-import org.sonar.core.sarif.Rule;
-import org.sonar.core.sarif.Run;
-import org.sonar.core.sarif.Tool;
+import org.sonar.sarif.pojo.ReportingDescriptor;
+import org.sonar.sarif.pojo.Result;
+import org.sonar.sarif.pojo.Run;
+import org.sonar.sarif.pojo.Tool;
+import org.sonar.sarif.pojo.ToolComponent;
 
 import static java.util.Collections.emptyList;
 import static java.util.stream.Collectors.toSet;
@@ -61,8 +60,8 @@ public class RunMapper {
     }
 
     String driverName = getToolDriverName(run);
-    Map<String, String> ruleSeveritiesByRuleId = detectRulesSeverities(run, driverName);
-    Map<String, String> ruleSeveritiesByRuleIdForNewCCT = detectRulesSeveritiesForNewTaxonomy(run, driverName);
+    Map<String, Result.Level> ruleSeveritiesByRuleId = detectRulesSeverities(run, driverName);
+    Map<String, Result.Level> ruleSeveritiesByRuleIdForNewCCT = detectRulesSeveritiesForNewTaxonomy(run, driverName);
 
     return new RunMapperResult()
       .newAdHocRules(toNewAdHocRules(run, driverName, ruleSeveritiesByRuleId, ruleSeveritiesByRuleIdForNewCCT))
@@ -78,13 +77,14 @@ public class RunMapper {
     return Optional.ofNullable(run)
       .map(Run::getTool)
       .map(Tool::getDriver)
-      .map(Driver::getName)
+      .map(ToolComponent::getName)
       .isPresent();
   }
 
-  private List<NewAdHocRule> toNewAdHocRules(Run run, String driverName, Map<String, String> ruleSeveritiesByRuleId, Map<String, String> ruleSeveritiesByRuleIdForNewCCT) {
-    Set<Rule> driverRules = run.getTool().getDriver().getRules();
-    Set<Rule> extensionRules = hasExtensions(run.getTool())
+  private List<NewAdHocRule> toNewAdHocRules(Run run, String driverName,
+    Map<String, Result.Level> ruleSeveritiesByRuleId, Map<String, Result.Level> ruleSeveritiesByRuleIdForNewCCT) {
+    Set<ReportingDescriptor> driverRules = run.getTool().getDriver().getRules();
+    Set<ReportingDescriptor> extensionRules = hasExtensions(run.getTool())
       ? run.getTool().getExtensions().stream().filter(RunMapper::hasRules).flatMap(extension -> extension.getRules().stream()).collect(toSet())
       : Set.of();
     return Stream.concat(driverRules.stream(), extensionRules.stream())
@@ -97,11 +97,12 @@ public class RunMapper {
     return tool.getExtensions() != null && !tool.getExtensions().isEmpty();
   }
 
-  private static boolean hasRules(Extension extension) {
+  private static boolean hasRules(ToolComponent extension) {
     return extension.getRules() != null && !extension.getRules().isEmpty();
   }
 
-  private List<NewExternalIssue> toNewExternalIssues(Run run, String driverName, Map<String, String> ruleSeveritiesByRuleId, Map<String, String> ruleSeveritiesByRuleIdForNewCCT) {
+  private List<NewExternalIssue> toNewExternalIssues(Run run, String driverName, Map<String, Result.Level> ruleSeveritiesByRuleId,
+    Map<String, Result.Level> ruleSeveritiesByRuleIdForNewCCT) {
     return run.getResults()
       .stream()
       .map(result -> toNewExternalIssue(driverName, ruleSeveritiesByRuleId.get(result.getRuleId()), ruleSeveritiesByRuleIdForNewCCT.get(result.getRuleId()), result))
@@ -110,7 +111,7 @@ public class RunMapper {
       .toList();
   }
 
-  private Optional<NewExternalIssue> toNewExternalIssue(String driverName, @Nullable String ruleSeverity, @Nullable String ruleSeverityForNewTaxonomy, Result result) {
+  private Optional<NewExternalIssue> toNewExternalIssue(String driverName, @Nullable Result.Level ruleSeverity, @Nullable Result.Level ruleSeverityForNewTaxonomy, Result result) {
     try {
       return Optional.of(resultMapper.mapResult(driverName, ruleSeverity, ruleSeverityForNewTaxonomy, result));
     } catch (Exception exception) {
diff --git a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/Sarif210Importer.java b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/Sarif210Importer.java
index af293a3dc11..9491ed63ed8 100644
--- a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/Sarif210Importer.java
+++ b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/Sarif210Importer.java
@@ -19,7 +19,7 @@
  */
 package org.sonar.scanner.externalissue.sarif;
 
-import org.sonar.core.sarif.Sarif210;
+import org.sonar.sarif.pojo.SarifSchema210;
 
 public interface Sarif210Importer {
 
@@ -28,5 +28,5 @@ public interface Sarif210Importer {
    * @param sarif210 the deserialized sarif report
    * @return the number of issues imported
    */
-  SarifImportResults importSarif(Sarif210 sarif210);
+  SarifImportResults importSarif(SarifSchema210 sarif210);
 }
diff --git a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/SarifIssuesImportSensor.java b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/SarifIssuesImportSensor.java
index 8d9d1218687..ce333db5216 100644
--- a/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/SarifIssuesImportSensor.java
+++ b/sonar-scanner-engine/src/main/java/org/sonar/scanner/externalissue/sarif/SarifIssuesImportSensor.java
@@ -39,8 +39,8 @@ import org.sonar.api.resources.Qualifiers;
 import org.sonar.api.scanner.ScannerSide;
 import org.sonar.api.scanner.sensor.ProjectSensor;
 import org.sonar.api.utils.MessageException;
-import org.sonar.core.sarif.Sarif210;
 import org.sonar.core.sarif.SarifSerializer;
+import org.sonar.sarif.pojo.SarifSchema210;
 
 import static java.lang.String.format;
 
@@ -101,7 +101,7 @@ public class SarifIssuesImportSensor implements ProjectSensor {
   private SarifImportResults processReport(SensorContext context, String reportPath) throws NoSuchFileException {
     LOG.debug("Importing SARIF issues from '{}'", reportPath);
     Path reportFilePath = context.fileSystem().resolvePath(reportPath).toPath();
-    Sarif210 sarifReport = sarifSerializer.deserialize(reportFilePath);
+    SarifSchema210 sarifReport = sarifSerializer.deserialize(reportFilePath);
     return sarifImporter.importSarif(sarifReport);
   }
 
diff --git a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/DefaultSarif210ImporterTest.java b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/DefaultSarif210ImporterTest.java
index 02cf0b875a2..689e3671af1 100644
--- a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/DefaultSarif210ImporterTest.java
+++ b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/DefaultSarif210ImporterTest.java
@@ -20,7 +20,6 @@
 package org.sonar.scanner.externalissue.sarif;
 
 import java.util.List;
-import java.util.Set;
 import junit.framework.TestCase;
 import org.junit.Rule;
 import org.junit.Test;
@@ -31,8 +30,8 @@ import org.mockito.junit.MockitoJUnitRunner;
 import org.slf4j.event.Level;
 import org.sonar.api.batch.sensor.issue.NewExternalIssue;
 import org.sonar.api.testfixtures.log.LogTester;
-import org.sonar.core.sarif.Run;
-import org.sonar.core.sarif.Sarif210;
+import org.sonar.sarif.pojo.Run;
+import org.sonar.sarif.pojo.SarifSchema210;
 import org.sonar.scanner.externalissue.sarif.RunMapper.RunMapperResult;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -56,11 +55,11 @@ public class DefaultSarif210ImporterTest extends TestCase {
 
   @Test
   public void importSarif_shouldDelegateRunMapping_toRunMapper() {
-    Sarif210 sarif210 = mock(Sarif210.class);
+    SarifSchema210 sarif210 = mock(SarifSchema210.class);
 
     Run run1 = mock(Run.class);
     Run run2 = mock(Run.class);
-    when(sarif210.getRuns()).thenReturn(Set.of(run1, run2));
+    when(sarif210.getRuns()).thenReturn(List.of(run1, run2));
 
     NewExternalIssue issue1run1 = mock(NewExternalIssue.class);
     NewExternalIssue issue2run1 = mock(NewExternalIssue.class);
@@ -80,11 +79,11 @@ public class DefaultSarif210ImporterTest extends TestCase {
 
   @Test
   public void importSarif_whenExceptionThrownByRunMapper_shouldLogAndContinueProcessing() {
-    Sarif210 sarif210 = mock(Sarif210.class);
+    SarifSchema210 sarif210 = mock(SarifSchema210.class);
 
     Run run1 = mock(Run.class);
     Run run2 = mock(Run.class);
-    when(sarif210.getRuns()).thenReturn(Set.of(run1, run2));
+    when(sarif210.getRuns()).thenReturn(List.of(run1, run2));
 
     Exception testException = new RuntimeException("test");
     when(runMapper.mapRun(run1)).thenThrow(testException);
@@ -102,7 +101,7 @@ public class DefaultSarif210ImporterTest extends TestCase {
 
   @Test
   public void importSarif_whenGetRunsReturnNull_shouldFailWithProperMessage() {
-    Sarif210 sarif210 = mock(Sarif210.class);
+    SarifSchema210 sarif210 = mock(SarifSchema210.class);
 
     when(sarif210.getRuns()).thenReturn(null);
 
diff --git a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/LocationMapperTest.java b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/LocationMapperTest.java
index 62a367094c7..18ddca2a866 100644
--- a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/LocationMapperTest.java
+++ b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/LocationMapperTest.java
@@ -35,8 +35,8 @@ import org.sonar.api.batch.fs.TextRange;
 import org.sonar.api.batch.sensor.SensorContext;
 import org.sonar.api.batch.sensor.issue.NewIssueLocation;
 import org.sonar.api.scanner.fs.InputProject;
-import org.sonar.core.sarif.Location;
-import org.sonar.core.sarif.Result;
+import org.sonar.sarif.pojo.Location;
+import org.sonar.sarif.pojo.Result;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
diff --git a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RegionMapperTest.java b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RegionMapperTest.java
index 462a4b0e3ce..6417ba175f5 100644
--- a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RegionMapperTest.java
+++ b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RegionMapperTest.java
@@ -36,7 +36,7 @@ import org.sonar.api.batch.fs.TextRange;
 import org.sonar.api.batch.fs.internal.DefaultIndexedFile;
 import org.sonar.api.batch.fs.internal.DefaultInputFile;
 import org.sonar.api.batch.fs.internal.Metadata;
-import org.sonar.core.sarif.Region;
+import org.sonar.sarif.pojo.Region;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatNullPointerException;
diff --git a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/ResultMapperTest.java b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/ResultMapperTest.java
index ea10a4f17fa..8c53ad8633d 100644
--- a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/ResultMapperTest.java
+++ b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/ResultMapperTest.java
@@ -22,7 +22,7 @@ package org.sonar.scanner.externalissue.sarif;
 import com.tngtech.java.junit.dataprovider.DataProvider;
 import com.tngtech.java.junit.dataprovider.DataProviderRunner;
 import com.tngtech.java.junit.dataprovider.UseDataProvider;
-import java.util.Set;
+import java.util.List;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -34,8 +34,8 @@ import org.sonar.api.batch.sensor.SensorContext;
 import org.sonar.api.batch.sensor.issue.NewExternalIssue;
 import org.sonar.api.batch.sensor.issue.NewIssueLocation;
 import org.sonar.api.rules.RuleType;
-import org.sonar.core.sarif.Location;
-import org.sonar.core.sarif.Result;
+import org.sonar.sarif.pojo.Location;
+import org.sonar.sarif.pojo.Result;
 
 import static org.assertj.core.api.Assertions.assertThatNullPointerException;
 import static org.mockito.ArgumentMatchers.any;
@@ -44,6 +44,7 @@ import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoMoreInteractions;
 import static org.mockito.Mockito.when;
+import static org.sonar.sarif.pojo.Result.Level.WARNING;
 import static org.sonar.scanner.externalissue.sarif.ResultMapper.DEFAULT_IMPACT_SEVERITY;
 import static org.sonar.scanner.externalissue.sarif.ResultMapper.DEFAULT_SEVERITY;
 import static org.sonar.scanner.externalissue.sarif.ResultMapper.DEFAULT_SOFTWARE_QUALITY;
@@ -51,8 +52,6 @@ import static org.sonar.scanner.externalissue.sarif.ResultMapper.DEFAULT_SOFTWAR
 @RunWith(DataProviderRunner.class)
 public class ResultMapperTest {
 
-  private static final String WARNING = "warning";
-  private static final String ERROR = "error";
   private static final String RULE_ID = "test_rules_id";
   private static final String DRIVER_NAME = "driverName";
 
@@ -105,7 +104,7 @@ public class ResultMapperTest {
   @Test
   public void mapResult_whenLocationExists_createsFileLocation() {
     Location location = mock(Location.class);
-    when(result.getLocations()).thenReturn(Set.of(location));
+    when(result.getLocations()).thenReturn(List.of(location));
 
     NewExternalIssue newExternalIssue = resultMapper.mapResult(DRIVER_NAME, WARNING, WARNING, result);
 
@@ -119,7 +118,7 @@ public class ResultMapperTest {
   @Test
   public void mapResult_whenLocationExistsButLocationMapperReturnsNull_createsProjectLocation() {
     Location location = mock(Location.class);
-    when(result.getLocations()).thenReturn(Set.of(location));
+    when(result.getLocations()).thenReturn(List.of(location));
     when(locationMapper.fillIssueInFileLocation(any(), any(), any())).thenReturn(null);
 
     NewExternalIssue newExternalIssue = resultMapper.mapResult(DRIVER_NAME, WARNING, WARNING, result);
@@ -156,18 +155,17 @@ public class ResultMapperTest {
   @DataProvider
   public static Object[][] rule_severity_to_sonarqube_severity_mapping() {
     return new Object[][] {
-      {"error", Severity.CRITICAL, org.sonar.api.issue.impact.Severity.HIGH},
-      {"warning", Severity.MAJOR, org.sonar.api.issue.impact.Severity.MEDIUM},
-      {"note", Severity.MINOR, org.sonar.api.issue.impact.Severity.LOW},
-      {"none", Severity.INFO, org.sonar.api.issue.impact.Severity.LOW},
-      {"anything else", DEFAULT_SEVERITY, DEFAULT_IMPACT_SEVERITY},
+      {Result.Level.ERROR, Severity.CRITICAL, org.sonar.api.issue.impact.Severity.HIGH},
+      {WARNING, Severity.MAJOR, org.sonar.api.issue.impact.Severity.MEDIUM},
+      {Result.Level.NOTE, Severity.MINOR, org.sonar.api.issue.impact.Severity.LOW},
+      {Result.Level.NONE, Severity.INFO, org.sonar.api.issue.impact.Severity.LOW},
       {null, DEFAULT_SEVERITY, DEFAULT_IMPACT_SEVERITY},
     };
   }
 
   @Test
   @UseDataProvider("rule_severity_to_sonarqube_severity_mapping")
-  public void mapResult_mapsCorrectlyLevelToSeverity(String ruleSeverity, Severity sonarQubeSeverity, org.sonar.api.issue.impact.Severity impactSeverity) {
+  public void mapResult_mapsCorrectlyLevelToSeverity(Result.Level ruleSeverity, Severity sonarQubeSeverity, org.sonar.api.issue.impact.Severity impactSeverity) {
     NewExternalIssue newExternalIssue = resultMapper.mapResult(DRIVER_NAME, ruleSeverity, ruleSeverity, result);
     verify(newExternalIssue).severity(sonarQubeSeverity);
     verify(newExternalIssue).addImpact(DEFAULT_SOFTWARE_QUALITY, impactSeverity);
diff --git a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RuleMapperTest.java b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RuleMapperTest.java
index 3c468c64161..da6cb4137f2 100644
--- a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RuleMapperTest.java
+++ b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RuleMapperTest.java
@@ -29,15 +29,15 @@ import org.mockito.MockitoAnnotations;
 import org.sonar.api.batch.sensor.SensorContext;
 import org.sonar.api.batch.sensor.rule.NewAdHocRule;
 import org.sonar.api.batch.sensor.rule.internal.DefaultAdHocRule;
-import org.sonar.core.sarif.Rule;
+import org.sonar.sarif.pojo.ReportingDescriptor;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.Mockito.when;
+import static org.sonar.sarif.pojo.Result.Level.WARNING;
 
 @RunWith(DataProviderRunner.class)
 public class RuleMapperTest {
 
-  private static final String WARNING = "warning";
   private static final String RULE_ID = "test_rules_id";
   private static final String DRIVER_NAME = "driverName";
 
@@ -55,7 +55,7 @@ public class RuleMapperTest {
 
   @Test
   public void mapRule_shouldCorrectlyMapToNewAdHocRule() {
-    Rule rule = Rule.builder().id(RULE_ID).build();
+    ReportingDescriptor rule = new ReportingDescriptor().withId(RULE_ID);
     NewAdHocRule expected = new DefaultAdHocRule()
       .severity(ResultMapper.DEFAULT_SEVERITY)
       .type(ResultMapper.DEFAULT_TYPE)
diff --git a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RulesSeverityDetectorTest.java b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RulesSeverityDetectorTest.java
index ec4085994ac..e0bc3df54b0 100644
--- a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RulesSeverityDetectorTest.java
+++ b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RulesSeverityDetectorTest.java
@@ -19,6 +19,7 @@
  */
 package org.sonar.scanner.externalissue.sarif;
 
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import org.assertj.core.api.Assertions;
@@ -27,41 +28,40 @@ import org.junit.Before;
 import org.junit.Test;
 import org.slf4j.event.Level;
 import org.sonar.api.testfixtures.log.LogTester;
-import org.sonar.core.sarif.DefaultConfiguration;
-import org.sonar.core.sarif.Driver;
-import org.sonar.core.sarif.Extension;
-import org.sonar.core.sarif.Result;
-import org.sonar.core.sarif.Rule;
-import org.sonar.core.sarif.Run;
-import org.sonar.core.sarif.Tool;
+import org.sonar.sarif.pojo.ReportingConfiguration;
+import org.sonar.sarif.pojo.ReportingDescriptor;
+import org.sonar.sarif.pojo.Result;
+import org.sonar.sarif.pojo.Run;
+import org.sonar.sarif.pojo.Tool;
+import org.sonar.sarif.pojo.ToolComponent;
 
 import static java.lang.String.format;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.AssertionsForClassTypes.tuple;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
+import static org.sonar.sarif.pojo.Result.Level.WARNING;
 import static org.sonar.scanner.externalissue.sarif.ResultMapper.DEFAULT_IMPACT_SEVERITY;
 import static org.sonar.scanner.externalissue.sarif.ResultMapper.DEFAULT_SEVERITY;
 
 public class RulesSeverityDetectorTest {
   private static final String DRIVER_NAME = "Test";
-  private static final String WARNING = "warning";
   private static final String RULE_ID = "RULE_ID";
 
   @org.junit.Rule
   public LogTester logTester = new LogTester().setLevel(Level.TRACE);
 
   private final Run run = mock(Run.class);
-  private final Rule rule = mock(Rule.class);
+  private final ReportingDescriptor rule = mock(ReportingDescriptor.class);
   private final Tool tool = mock(Tool.class);
   private final Result result = mock(Result.class);
-  private final Driver driver = mock(Driver.class);
-  private final Extension extension = mock(Extension.class);
-  private final DefaultConfiguration defaultConfiguration = mock(DefaultConfiguration.class);
+  private final ToolComponent driver = mock(ToolComponent.class);
+  private final ToolComponent extension = mock(ToolComponent.class);
+  private final ReportingConfiguration defaultConfiguration = mock(ReportingConfiguration.class);
 
   @Before
   public void setUp() {
-    when(run.getResults()).thenReturn(Set.of(result));
+    when(run.getResults()).thenReturn(List.of(result));
     when(run.getTool()).thenReturn(tool);
     when(tool.getDriver()).thenReturn(driver);
   }
@@ -71,7 +71,7 @@ public class RulesSeverityDetectorTest {
   public void detectRulesSeverities_detectsCorrectlyResultDefinedRuleSeverities() {
     Run run = mockResultDefinedRuleSeverities();
 
-    Map<String, String> rulesSeveritiesByRuleId = RulesSeverityDetector.detectRulesSeverities(run, DRIVER_NAME);
+    Map<String, Result.Level> rulesSeveritiesByRuleId = RulesSeverityDetector.detectRulesSeverities(run, DRIVER_NAME);
 
     assertNoLogs();
     assertDetectedRuleSeverities(rulesSeveritiesByRuleId, tuple(RULE_ID, WARNING));
@@ -81,7 +81,7 @@ public class RulesSeverityDetectorTest {
   public void detectRulesSeveritiesForNewTaxonomy_shouldReturnsEmptyMapAndLogsWarning_whenOnlyResultDefinedRuleSeverities() {
     Run run = mockResultDefinedRuleSeverities();
 
-    Map<String, String> rulesSeveritiesByRuleId = RulesSeverityDetector.detectRulesSeveritiesForNewTaxonomy(run, DRIVER_NAME);
+    Map<String, Result.Level> rulesSeveritiesByRuleId = RulesSeverityDetector.detectRulesSeveritiesForNewTaxonomy(run, DRIVER_NAME);
 
     assertWarningLog(DEFAULT_IMPACT_SEVERITY.name());
     assertDetectedRuleSeverities(rulesSeveritiesByRuleId);
@@ -91,7 +91,7 @@ public class RulesSeverityDetectorTest {
   public void detectRulesSeverities_detectsCorrectlyDriverDefinedRuleSeverities() {
     Run run = mockDriverDefinedRuleSeverities();
 
-    Map<String, String> rulesSeveritiesByRuleId = RulesSeverityDetector.detectRulesSeveritiesForNewTaxonomy(run, DRIVER_NAME);
+    Map<String, Result.Level> rulesSeveritiesByRuleId = RulesSeverityDetector.detectRulesSeveritiesForNewTaxonomy(run, DRIVER_NAME);
 
     assertNoLogs();
     assertDetectedRuleSeverities(rulesSeveritiesByRuleId, tuple(RULE_ID, WARNING));
@@ -107,7 +107,7 @@ public class RulesSeverityDetectorTest {
   public void detectRulesSeverities_detectsCorrectlyExtensionsDefinedRuleSeverities() {
     Run run = mockExtensionsDefinedRuleSeverities();
 
-    Map<String, String> rulesSeveritiesByRuleId = RulesSeverityDetector.detectRulesSeveritiesForNewTaxonomy(run, DRIVER_NAME);
+    Map<String, Result.Level> rulesSeveritiesByRuleId = RulesSeverityDetector.detectRulesSeveritiesForNewTaxonomy(run, DRIVER_NAME);
 
     assertNoLogs();
     assertDetectedRuleSeverities(rulesSeveritiesByRuleId, tuple(RULE_ID, WARNING));
@@ -123,7 +123,7 @@ public class RulesSeverityDetectorTest {
   public void detectRulesSeverities_returnsEmptyMapAndLogsWarning_whenUnableToDetectSeverities() {
     Run run = mockUnsupportedRuleSeveritiesDefinition();
 
-    Map<String, String> rulesSeveritiesByRuleId = RulesSeverityDetector.detectRulesSeveritiesForNewTaxonomy(run, DRIVER_NAME);
+    Map<String, Result.Level> rulesSeveritiesByRuleId = RulesSeverityDetector.detectRulesSeveritiesForNewTaxonomy(run, DRIVER_NAME);
 
     assertWarningLog(DEFAULT_IMPACT_SEVERITY.name());
     assertDetectedRuleSeverities(rulesSeveritiesByRuleId);
@@ -136,7 +136,7 @@ public class RulesSeverityDetectorTest {
   }
 
   private Run mockResultDefinedRuleSeverities() {
-    when(run.getResults()).thenReturn(Set.of(result));
+    when(run.getResults()).thenReturn(List.of(result));
     when(result.getLevel()).thenReturn(WARNING);
     when(result.getRuleId()).thenReturn(RULE_ID);
     return run;
@@ -146,7 +146,7 @@ public class RulesSeverityDetectorTest {
     when(driver.getRules()).thenReturn(Set.of(rule));
     when(rule.getId()).thenReturn(RULE_ID);
     when(rule.getDefaultConfiguration()).thenReturn(defaultConfiguration);
-    when(defaultConfiguration.getLevel()).thenReturn(WARNING);
+    when(defaultConfiguration.getLevel()).thenReturn(ReportingConfiguration.Level.WARNING);
     return run;
   }
 
@@ -156,7 +156,7 @@ public class RulesSeverityDetectorTest {
     when(extension.getRules()).thenReturn(Set.of(rule));
     when(rule.getId()).thenReturn(RULE_ID);
     when(rule.getDefaultConfiguration()).thenReturn(defaultConfiguration);
-    when(defaultConfiguration.getLevel()).thenReturn(WARNING);
+    when(defaultConfiguration.getLevel()).thenReturn(ReportingConfiguration.Level.WARNING);
     return run;
   }
 
@@ -173,7 +173,7 @@ public class RulesSeverityDetectorTest {
     assertThat(logTester.logs()).isEmpty();
   }
 
-  private static void assertDetectedRuleSeverities(Map<String, String> severities, Tuple... expectedSeverities) {
+  private static void assertDetectedRuleSeverities(Map<String, Result.Level> severities, Tuple... expectedSeverities) {
     Assertions.assertThat(severities.entrySet())
       .extracting(Map.Entry::getKey, Map.Entry::getValue)
       .containsExactly(expectedSeverities);
diff --git a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RunMapperTest.java b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RunMapperTest.java
index 8c03e6cd99a..407c229e31b 100644
--- a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RunMapperTest.java
+++ b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/RunMapperTest.java
@@ -19,6 +19,7 @@
  */
 package org.sonar.scanner.externalissue.sarif;
 
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import org.junit.Before;
@@ -34,22 +35,22 @@ import org.slf4j.event.Level;
 import org.sonar.api.batch.sensor.issue.NewExternalIssue;
 import org.sonar.api.batch.sensor.rule.NewAdHocRule;
 import org.sonar.api.testfixtures.log.LogTester;
-import org.sonar.core.sarif.Extension;
-import org.sonar.core.sarif.Result;
-import org.sonar.core.sarif.Run;
+import org.sonar.sarif.pojo.ReportingDescriptor;
+import org.sonar.sarif.pojo.Result;
+import org.sonar.sarif.pojo.Run;
+import org.sonar.sarif.pojo.ToolComponent;
 import org.sonar.scanner.externalissue.sarif.RunMapper.RunMapperResult;
 
-import static java.util.Collections.emptySet;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
 import static org.assertj.core.api.Assertions.assertThatNoException;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.mockStatic;
 import static org.mockito.Mockito.when;
+import static org.sonar.sarif.pojo.Result.Level.WARNING;
 
 @RunWith(MockitoJUnitRunner.class)
 public class RunMapperTest {
-  private static final String WARNING = "warning";
   private static final String TEST_DRIVER = "Test driver";
   public static final String RULE_ID = "ruleId";
 
@@ -63,7 +64,7 @@ public class RunMapperTest {
   private Run run;
 
   @Mock
-  private org.sonar.core.sarif.Rule rule;
+  private ReportingDescriptor rule;
 
   @Rule
   public LogTester logTester = new LogTester();
@@ -82,7 +83,7 @@ public class RunMapperTest {
   public void mapRun_shouldMapExternalIssues() {
     Result result1 = mock(Result.class);
     Result result2 = mock(Result.class);
-    when(run.getResults()).thenReturn(Set.of(result1, result2));
+    when(run.getResults()).thenReturn(List.of(result1, result2));
     NewExternalIssue externalIssue1 = mockMappedExternalIssue(result1);
     NewExternalIssue externalIssue2 = mockMappedExternalIssue(result2);
 
@@ -116,7 +117,7 @@ public class RunMapperTest {
   @Test
   public void mapRun_shouldMapExternalRules_whenRulesInExtensions() {
     when(run.getTool().getDriver().getRules()).thenReturn(Set.of());
-    Extension extension = mock(Extension.class);
+    ToolComponent extension = mock(ToolComponent.class);
     when(extension.getRules()).thenReturn(Set.of(rule));
     when(run.getTool().getExtensions()).thenReturn(Set.of(extension));
     NewAdHocRule externalRule = mockMappedExternalRule();
@@ -135,7 +136,7 @@ public class RunMapperTest {
   @Test
   public void mapRun_shouldNotFail_whenExtensionsDontHaveRules() {
     when(run.getTool().getDriver().getRules()).thenReturn(Set.of(rule));
-    Extension extension = mock(Extension.class);
+    ToolComponent extension = mock(ToolComponent.class);
     when(extension.getRules()).thenReturn(null);
     when(run.getTool().getExtensions()).thenReturn(Set.of(extension));
 
@@ -150,7 +151,7 @@ public class RunMapperTest {
   @Test
   public void mapRun_shouldNotFail_whenExtensionsHaveEmptyRules() {
     when(run.getTool().getDriver().getRules()).thenReturn(Set.of(rule));
-    Extension extension = mock(Extension.class);
+    ToolComponent extension = mock(ToolComponent.class);
     when(extension.getRules()).thenReturn(Set.of());
     when(run.getTool().getExtensions()).thenReturn(Set.of(extension));
 
@@ -164,7 +165,7 @@ public class RunMapperTest {
 
   @Test
   public void mapRun_ifRunIsEmpty_returnsEmptyList() {
-    when(run.getResults()).thenReturn(emptySet());
+    when(run.getResults()).thenReturn(List.of());
 
     RunMapperResult runMapperResult = runMapper.mapRun(run);
 
@@ -175,7 +176,7 @@ public class RunMapperTest {
   public void mapRun_ifExceptionThrownByResultMapper_logsThemAndContinueProcessing() {
     Result result1 = mock(Result.class);
     Result result2 = mock(Result.class);
-    when(run.getResults()).thenReturn(Set.of(result1, result2));
+    when(run.getResults()).thenReturn(List.of(result1, result2));
     NewExternalIssue externalIssue2 = mockMappedExternalIssue(result2);
     when(result1.getRuleId()).thenReturn(RULE_ID);
     when(resultMapper.mapResult(TEST_DRIVER, WARNING, WARNING, result1)).thenThrow(new IllegalArgumentException("test"));
diff --git a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/SarifIssuesImportSensorTest.java b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/SarifIssuesImportSensorTest.java
index 74fb5cbdd1d..d5d458118d1 100644
--- a/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/SarifIssuesImportSensorTest.java
+++ b/sonar-scanner-engine/src/test/java/org/sonar/scanner/externalissue/sarif/SarifIssuesImportSensorTest.java
@@ -36,8 +36,8 @@ import org.sonar.api.testfixtures.log.LogAndArguments;
 import org.sonar.api.testfixtures.log.LogTester;
 import org.sonar.api.utils.MessageException;
 import org.sonar.api.utils.log.LoggerLevel;
-import org.sonar.core.sarif.Sarif210;
 import org.sonar.core.sarif.SarifSerializer;
+import org.sonar.sarif.pojo.SarifSchema210;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
@@ -196,7 +196,7 @@ public class SarifIssuesImportSensorTest {
   }
 
   private ReportAndResults mockSuccessfulReportAndResults(String path) throws NoSuchFileException {
-    Sarif210 report = mockSarifReport(path);
+    SarifSchema210 report = mockSarifReport(path);
 
     SarifImportResults sarifImportResults = mock(SarifImportResults.class);
     when(sarifImportResults.getSuccessFullyImportedIssues()).thenReturn(10);
@@ -207,15 +207,15 @@ public class SarifIssuesImportSensorTest {
     return new ReportAndResults(report, sarifImportResults);
   }
 
-  private Sarif210 mockSarifReport(String path) throws NoSuchFileException {
-    Sarif210 report = mock(Sarif210.class);
+  private SarifSchema210 mockSarifReport(String path) throws NoSuchFileException {
+    SarifSchema210 report = mock(SarifSchema210.class);
     Path reportFilePath = sensorContext.fileSystem().resolvePath(path).toPath();
     when(sarifSerializer.deserialize(reportFilePath)).thenReturn(report);
     return report;
   }
 
   private ReportAndResults mockFailedReportAndResults(String path) throws NoSuchFileException {
-    Sarif210 report = mockSarifReport(path);
+    SarifSchema210 report = mockSarifReport(path);
 
     SarifImportResults sarifImportResults = mock(SarifImportResults.class);
     when(sarifImportResults.getSuccessFullyImportedRuns()).thenReturn(0);
@@ -226,7 +226,7 @@ public class SarifIssuesImportSensorTest {
   }
 
   private ReportAndResults mockMixedReportAndResults(String path) throws NoSuchFileException {
-    Sarif210 report = mockSarifReport(path);
+    SarifSchema210 report = mockSarifReport(path);
 
     SarifImportResults sarifImportResults = mock(SarifImportResults.class);
     when(sarifImportResults.getSuccessFullyImportedIssues()).thenReturn(10);
@@ -270,15 +270,15 @@ public class SarifIssuesImportSensorTest {
   }
 
   private static class ReportAndResults {
-    private final Sarif210 sarifReport;
+    private final SarifSchema210 sarifReport;
     private final SarifImportResults sarifImportResults;
 
-    private ReportAndResults(Sarif210 sarifReport, SarifImportResults sarifImportResults) {
+    private ReportAndResults(SarifSchema210 sarifReport, SarifImportResults sarifImportResults) {
       this.sarifReport = sarifReport;
       this.sarifImportResults = sarifImportResults;
     }
 
-    private Sarif210 getSarifReport() {
+    private SarifSchema210 getSarifReport() {
       return sarifReport;
     }