Comment by rcfox

It looks like SARIF is JSON, with a formal schema. I'm guessing the JSON they used to output used their own, non-standard schema.