I would recommend Checkmarx product for application security. The Checkmarx product is primarily focused to identify the security issues. The SonarQube offers very limited rules for application security and it is basically used for code quality metrics.