ValidIaC should return the output in SARIF (a standard, JSON-based format for the output of static analysis tools) [An example](http://json.schemastore.org/sarif-2.1.0-rtm.4)