HCL AppScan Enterprise delivers scalable application security testing and risk management capabilities, to help enterprises manage risk and compliance. HCL AppScan enables security, DevOps teams to collaborate, establish policies, and perform testing throughout the application development lifecycle.
The AppScan Enterprise plugin provides integration with an HCL AppScan Enterprise server. This plugin retrieves the security vulnerability report of the application and displays it as Insights metrics.
The following table describes the changes made in each plugin version.
| Version | Description |
|---|---|
| 2.0.35 | Scheduled Event Functionality Added, UAK Changes, Issue Level Data Chart Added. |
| 1.0.23 | Minor enhancements |
| 1.0.22 | Minor enhancements |
To use the AppScan Enterprise plugin, the plugin must be loaded and an instance created before you can configure the plugin integration. You define configuration properties in the user interface or in a JSON file. After the integration is complete, to invoke the plugin send an HTTP Post request to the plugin endpoint
The AppScan Enterprise plugin supports endpoint integration which are listed in the following table.
| Name | Path | Method |
|---|---|---|
| AppScan Callback | appscan/callback | Put |
To import data from the HCL AppScan Enterprise server, send an HTTP POST request to your endpoint such as the following sample.
Summary
Usage
Configuration Properties
https:///pluginEndpoint//appscan/callback
The payload for the POST is shown below.
{"application":"", "buildUrl": ""}.
| Name | Description |
|---|---|
| application | he application name from the scan ran in Appscan Enterprise. It is a mandatory field to render the scan results in HCL Accelerate. |
| buildUrl | The build URL from Jenkins or any other CI/CD tool. It is an optional field which links the Appscan Enterprise scan results with VSM. |
There are two methods to integrate the plugin:
The tables in the Configuration properties topic describe the properties used to define the integration.
The JSON file contains the information for creating a value stream. Within the JSON file is a section for integrations. It is in this section that plugin properties can be defined.
The HCL AppScan Enterprise (ASE) Account used to generate the token must have access to the project which is being integrated with HCL Accelerate.
The following tables describe the properties used to configure the integration. Each table contains the field name when using the user interface and the property name when using a JSON file.
properties configuration property.Some properties might not be displayed in the user interface, to see all properties enable the Show Hidden Properties field.
| Name | Description | Required | Property Name |
|---|---|---|---|
| NA | The version of the plugin that you want to use. To view available versions, click the Version History tab. If a value is not specified, the version named latest is used. | No | image |
| Integration Name | An assigned name to the value stream. | Yes | name |
| Logging Level | The level of Log4j messages to display in the log file. Valid values are: all, debug, info, warn, error, fatal, off, and trace. | No | loggingLevel |
| NA | List of plugin configuration properties used to connect and communicate with the HCL AppScan Enterprise server. Enclose the properties within braces. | Yes | properties |
| The name of the tenant. | Yes | tenant_id | |
| NA | Unique identifier assigned to the plugin. The value for the HCL AppScan Enterprise plugin is ucv-ext-appscan |
Yes | type |
<td”>The user name to use to authenticate with the HCL AppScan Enterprise server.Yesusername
| Name | Type | Description | Required | Property Name |
|---|---|---|---|---|
| Password | Secure | The password to authenticate with the HCL AppScan Enterprise server. | Yes | password |
| HCL Accelerate User Access Key | Secure | The user access key to authenticate with the HCL Accelerate server. | Yes | ucvAccessKey |
| User Name | String | The user name to use to authenticate with the HCL AppScan Enterprise server. | Yes | username |
| URL | String | The URL of the HCL AppScan Enterprise server. Include the port number. | Yes | url |
| Applications | Multiline | Newline seperated list of application names. If kept empty all applications will be synced. | no | applications |
Uploaded: 04-Apr-2024 08:33
docker pull hclcr.io/accelerate/ucv-ext-appscan:2.0.51
Uploaded: 25-Sep-2023 10:51
docker pull hclcr.io/accelerate/ucv-ext-appscan:2.0.48
Uploaded: 18-May-2023 06:01
Uploaded: 17-Oct-2022 12:31
Uploaded: 01-Mar-2022 09:38
Uploaded: 03-May-2021 13:47
Uploaded: 07-Apr-2021 06:28
Uploaded: 08-Feb-2021 07:31
Uploaded: 08-Feb-2021 07:31
