Usage

To use the HCL AppScan on Cloud plug-in (ASoC), the plug-in must be loaded, and an instance is created before you can configure the plug-in integration. You can define configuration properties either in the user interface or in a JSON file of a value stream.

Minimum permission to integrate with HCL AppScan on Cloud (ASoC)

The HCL AppScan on Cloud (ASoC) Account used to generate the token must have access to the project which is being integrated with HCL DevOps Velocity.

Integration type

The ASoC plug-in supports endpoint integration and a scheduled event integration.

Integration

To install the plug-in, perform the following steps:

1. In HCL DevOps Velocity, click Settings > Integrations > Available.
2. In the Action column for the HCL AppScan on Cloud (ASoC) plug-in, click Install.

There are two methods to integrate the plug-in:

• Using the user interface
• Using a JSON file

Integrating the plug-in by using user interface

To integrate the plug-in using the user interface, perform the following steps:

1. In HCL DevOps Velocity, click Settings > Integrations > Installed.
2. In the Action column for the HCL AppScan on Cloud (ASoC) plug-in, click Add Integration.
3. On the Add Integration dialog, enter the values for the fields to configure the integration and define communication.
4. Click Add.

Integrating the plug-in by using JSON file

The JSON file contains the information for creating a value stream. Within the JSON file is a section for integrations. It is in this section that plugin properties can be defined. Refer to the sample SJo

To integrate the plug-in using a JSON, perform the following steps:

1. Navigate to value stream page, and then click the necessary value stream.
2. Click icon, and then Select Edit value stream to modify the JSON file in the code or tree view editors.
3. Alternatively, you can also click Download JSON option to download the JSON file, and then select the Import JSON option to upload the revised JSON file.
4. Edit the integration information in the JSON file to add the plug-in configuration properties. Refer to JSON sample code in the Configuration Properties section more details.
5. Click Save.

The following image shows the ASoC scan results in the Insights section of DevOps Velocity after the successful plug-in integration.

Endpoint integration

You can use the ASoC plug-in’s endpoint integration to sync or import the scan data into HCL DevOps Velocity’s application vulnerabilities metrics by triggering the API endpoint with GET or POST request.

The endpoint integration is listed in the following table.

The following image shows the endpoint after the integration is defined in HCL DevOps Velocity:

Notes

The following two features are available from version 2.0.1 or later of the plug-in:

1. The plug-in imports historical scan data from ASoC.
   • To sync or import the scan data into HCL DevOps Velocity, update the ASoC applications field in the plug-in configuration with the application names in ASoC. The plug-in will import the latest scan data from ASoC.
2. The plug-in supports ASoC webhooks.
   • The plug-in endpoint can be defined as a webhook in ASoC. When the webhook is called by ASoC after every scan execution, the plug-in will run and import the scan data from ASoC to HCL DevOps Velocity.
   • To call out ASoC scan using REST API, pass the ‘build url’ as a ‘Comment’ as shown in the below example. As a result, the plug-in imports the ‘build url’ and associate the scan result to the specific ‘build’ / ‘build url’ in HCL DevOps Velocity.

   curl --location --request POST 'https://cloud.appscan.com/api/v2/Scans/MobileAnalyzer' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Bearer bearer-token-goes-here' \
--data-urlencode 'ApplicationFileId=file-id-goes-here' \
--data-urlencode 'ScanName=scan-name-goes-here' \
--data-urlencode 'AppId=ASoC-AppId-goes-here' \
--data-urlencode 'Execute=true' \
--data-urlencode 'Comment=https://build-url-goes-here'

   • Running the ASoC scan using User Interface (UI) will not associate the scan result to the build url in HCL DevOps Velocity.
   • To use the webhook, you must install AppScan presence on the machine where HCL DevOps Velocity is running. For more information, see ASoC documentation.
   • The following is an example of creating a webhook in ASoC.

   curl --location --request POST 'https://cloud.appscan.com/api/V2/Webhooks' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Bearer bearer-token-value-goes-here' \
--data-urlencode 'PresenceId=presence-id-goes-here' \
--data-urlencode 'Uri=plugin-endpoint-goes-here?ScanExecutionId={SubjectId}' \
--data-urlencode 'Event=ScaneExecutionCompleted' \
--data-urlencode 'Global=true'

The following example shows calling the plug-in end point using a ‘non webhook’ method, such as CURL, Postman, or as a part of the CI/ CD pipeline.

Send an HTTP GET (For version 2.0.1 or later) or HTTP POST (For version 2.0.0 or earlier) request to your endpoint.
Sample endpoint:
https:///pluginEndpoint//asocScan

The payload for the POST is shown below.
{"scanId":"", "buildUrl": ""}.

Scheduled integration

You can use the HCL AppScan on Cloud plug-in’s scheduled event integration to automatically sync or import the scan data into HCL DevOps Velocity’s application vulnerabilities metrics at regular interval of time. Currently, HCL AppScan on Cloud plug-in sync or import scan data from HCL AppScan on Cloud to HCL DevOps Velocity at an interval of 5 minutes.

The following image shows the Scheduled Event after the integration is defined in HCL DevOps Velocity:

The following image shows the ASoC scan results in the Insights section of DevOps Velocity after the successful plug-in integration.

Minimum permission to integrate with HCL AppScan on Cloud (ASoC)

The HCL AppScan on Cloud (ASoC) Account used to generate the token must have access to the project which is being integrated with HCL DevOps Velocity .

Configuration Properties

The following tables describe the properties used to configure the integration. Each table contains the field name when using the user interface and the property name when using a JSON file.

• The General configuration properties table describes configuration properties used by all plug-in integrations.
• The HCL AppScan on Cloud configuration Properties table describes the configuration properties that define the connection and communications with the HCL DevOps Velocity server. When using the JSON method to integrate the plug-in these properties are coded within the properties configuration property.

Some properties might not be displayed in the user interface, to see all properties enable the Show Hidden Properties field.

JSON code sample

The following sample code can be used as a template to define the integration within the JSON file for a value stream. Copy and paste the template into the JSON file Integration section and make the appropriate changes.

"integrations": [
  {
    "type": "asocPlugin",
    "tenant_id": "",
    "name": "",
    "properties":{
      "ucvAccessKey": "",
      "keyId" : "",
      "keySecret":"",
      "isScheduledEvent":"false"
      "asocUrl":"",
      "applications":""
    }
 }
]