HCL AppScan 360 Steps
The HCL AppScan 360 plugin provides steps for managing presences and running Dynamic Analyzer, Static Analyzer, and Software Composition Analysis (SCA) scans in HCL AppScan 360.
Note: Properties marked (Hidden) are plugin properties that are not displayed in the standard step configuration UI.
Create AS360 Presence
Create and start a new presence. To access a private site server you must start the presence in an environment that has local access to the server. The 'PresenceId' output property generated can be used to run scans in environments that do not have access to the private site.
| Name | Type | Description | Required |
|---|---|---|---|
| baseUrlApp | textBox | Please enter a base AS360 URL. Ex- cloud.appscan.com, cloud.appscan.com/eu. | Yes |
| keyId | textBox | The API key ID to authenticate with AS360. | Yes |
| keySecret | secureBox | The API key secret to authenticate with AS360. | Yes |
| startPresence | checkBox | Select this option to start the presence after it is created. | No |
| validateSSL | checkBox | Enable TLS certificate validation for the AS360 server. Clear this only for test environments that use self-signed or untrusted certificates. | No |
Delete AS360 Presence
Delete an AS360 presence. The presence will subsequently be stopped on any machine where it is currently running.
| Name | Type | Description | Required |
|---|---|---|---|
| baseUrlApp | textBox | Please enter a base AS360 URL. Ex- cloud.appscan.com, cloud.appscan.com/eu. | Yes |
| deleteAll | checkBox | Select this box to remove all existing AS360 presences that can be accessed with the provided login credentials. | No |
| keyId | textBox | The API key ID to authenticate with AS360. | Yes |
| keySecret | secureBox | The API key secret to authenticate with AS360. | Yes |
| presenceId | textBox | Specify an ID of an existing presence that is accessible using the provided login credentials. This field will be ignored if the 'Delete All Presences' box is checked. | No |
| validateSSL | checkBox | Enable TLS certificate validation for the AS360 server. Clear this only for test environments that use self-signed or untrusted certificates. | No |
Start AS360 Presence
Start an existing AS360 presence. The presence will be started on the agent machine that runs the step.
| Name | Type | Description | Required |
|---|---|---|---|
| baseUrlApp | textBox | Please enter a base AS360 URL. Ex- cloud.appscan.com, cloud.appscan.com/eu. | Yes |
| keyId | textBox | The API key ID to authenticate with AS360. | Yes |
| keySecret | secureBox | The API key secret to authenticate with AS360. | Yes |
| presenceId | textBox | Specify an ID of an existing presence, which allows you to run scans on apps not connected to the internet or require a proxy server to make a connection. The presence must be accessible to the user. | No |
| renewKey | checkBox | Select this option to renew the key before starting the presence. | No |
| validateSSL | checkBox | Enable TLS certificate validation for the AS360 server. Clear this only for test environments that use self-signed or untrusted certificates. | No |
Start Dynamic Analyzer AS360 Scan
Starts a new Dynamic Analyzer AS360 Scan, using HCL AppScan 360. This step will generate the 'ScanId' output property.
| Name | Type | Description | Required |
|---|---|---|---|
| applicationId | textBox | The ID of the application in AS360. | Yes |
| baseUrlApp | textBox | Please enter a base AS360 URL to scan. Ex- cloud.appscan.com, cloud.appscan.com/eu. | Yes |
| buildUrl | textBox | Optional build URL to attach in the scan comment metadata. | No |
| commitSha | textBox | Optional commit SHA to attach in the scan comment metadata. | No |
| environment | textBox | Optional environment value to attach in the scan comment metadata. | No |
| failOnPause | checkBox | (Hidden) Select this option to immediately fail the process if the scan is paused. If unchecked, the process will continue running. | No |
| keyId | textBox | The API key ID to authenticate with AS360. | Yes |
| keySecret | secureBox | The API key secret to authenticate with AS360. | Yes |
| mailNotification | checkBox | Select this option to notify email IDs configured in AS360. | No |
| outputIssues | checkBox | Selecting this will wait for the scan results and set the criticalIssueCount, highIssueCount, medIssueCount, lowIssueCount, and infoIssueCount output properties. | No |
| parentScanId | textBox | If this is a rescan please enter the original scan id | No |
| presenceId | textBox | Specify an ID of an existing presence, which allows you to run scans on apps not connected to the internet or require a proxy server to make a connection. The presence must be accessible to the user. | No |
| reportIssueCountValidation | textBox | Please set the number of issues found (by severity) in a comma-separated list. If the threshold is reached during the scan, the scan will fail. In this field, you can specify the numbers for these severity levels: Critical (C), High (H), Medium (M), Low (L), and Informational (I). For example, a fail condition of '0,0,5,10,20' will cause the step to fail if the resulting scan has more than 0 Critical issues, 0 High issues, 5 Medium issues, and so on. If this field is left empty, there will be no validation of results and the scan will not fail as a result of a fail condition. | No |
| scanFile | textBox | The path to a configuration (SCAN or SCANT) file. Use this field if you have specific configuration requirements. The Starting URL that you enter above must be identical to the Starting URL in the file. | No |
| scanName | textBox | Enter a name for the scan. If empty, the Starting URL will be used. | No |
| scanPassword | secureBox | Password for the scanned application if it contains a login. | No |
| scanTimeout | textBox | (Hidden) Please enter a timeout for the scan (relevant for only when validating report). The default value of -1 will cause the scan to run until it completes. | No |
| scanType | selectBox | Select the type of scan. Staging scans are more comprehensive and designed to scan sites before production. Production scans are designed to scan live sites. | No |
| scanUser | textBox | Username for the scanned application if it contains a login. | No |
| startingUrl | textBox | Please enter a URL to scan. (You must complete Domain Verification through the UI, as it is not currently supported by this plugin.) | Yes |
| testPolicy | selectBox | A predefined set of tests for AppScan to use. Here is a short description for each option: Comprehensive (Default) -> This is the most thorough Test Set and is used by default. Application-Only -> This Test Set includes all application level tests except invasive and port listener tests. The Vital Few -> This Test Set includes a selection of tests that have a high probability of success. This can be useful for evaluating a site when time is limited. | No |
| thirdCredential | secureBox | Provide this field if your application requires a third credential. | No |
| validateSSL | checkBox | Enable TLS certificate validation for the AS360 server. Clear this only for test environments that use self-signed or untrusted certificates. | No |
Start Static Analyzer AS360 Scan
Starts a new Static Analyzer AS360 Scan, using HCL AppScan on Cloud. This step will generate the 'ScanId' output property.
| Name | Type | Description | Required |
|---|---|---|---|
| applicationId | textBox | The ID of the application in AS360. | Yes |
| arsaToolDir | textBox | Please point to the directory that the client tool was unzipped to. For example, C:\SAClientUtil. This property must be supplied if you need to generate the IRX file. | No |
| baseUrlApp | textBox | Please enter a base AS360 URL to scan. Ex- cloud.appscan.com, cloud.appscan.com/eu. | Yes |
| buildUrl | textBox | Optional build URL to attach in the scan comment metadata. | No |
| commitSha | textBox | Optional commit SHA to attach in the scan comment metadata. | No |
| environment | textBox | Optional environment value to attach in the scan comment metadata. | No |
| failOnPause | checkBox | (Hidden) Select this option to immediately fail the process if the scan is paused. If unchecked, the process will continue running. | No |
| keyId | textBox | The API key ID to authenticate with AS360. | Yes |
| keySecret | secureBox | The API key secret to authenticate with AS360. | Yes |
| mailNotification | checkBox | Select this option to notify email IDs configured in AS360. | No |
| parentScanId | textBox | If you have previously scanned the application, please enter the original scan ID here if you want to rescan it. | No |
| reportIssueCountValidation | textBox | Please set the number of issues found (by severity) in a comma-separated list. If the threshold is reached during the scan, the scan will fail. In this field, you can specify the numbers for these severity levels: Critical (C), High (H), Medium (M), Low (L), and Informational (I). For example, a fail condition of '0,0,5,10,20' will cause the step to fail if the resulting scan has more than 0 Critical issues, 0 High issues, 5 Medium issues, and so on. If this field is left empty, there will be no validation of results and the scan will not fail as a result of a fail condition. | No |
| sastConfigFile | textBox | Please point to the path and file name of a scan configuration file. This overrides any scan configuration files which may exist in the scan directory. For example, 'c:\build_output\appscan-config.xml'. | No |
| sastFileLocation | textBox | Please point to the IRX file to be uploaded for scanning, or the directory that contains the files or other locations to scan. The files and locations that can be specified in this field include: .jar files, .war files, .ear files, Eclipse workspaces, and scan configuration files. For example, 'c:\build_output\testapp.irx' or 'c:\build_output'. | Yes |
| scanTimeout | textBox | (Hidden) Please enter a timeout for the scan (relevant for only when validating report). The default value of -1 will cause the scan to run until it completes. | No |
| validateSSL | checkBox | Enable TLS certificate validation for the AS360 server. Clear this only for test environments that use self-signed or untrusted certificates. | No |
Start Software Composition Analysis (SCA) AS360 Scan
Starts a new Software Composition Analysis (SCA) AS360 Scan, using HCL AppScan 360. This step will generate the 'ScanId' output property.
| Name | Type | Description | Required |
|---|---|---|---|
| applicationId | textBox | The ID of the application in AS360. | Yes |
| arsaToolDir | textBox | Please point to the directory that the client tool was unzipped to. For example, C:\SAClientUtil. This property must be supplied if you need to generate the IRX file. | No |
| baseUrlApp | textBox | Please enter a base AS360 URL to scan. Ex- cloud.appscan.com, cloud.appscan.com/eu. | Yes |
| buildUrl | textBox | (Hidden) Optional build URL to attach in the scan comment metadata. | No |
| keyId | textBox | The API key ID to authenticate with AS360. | Yes |
| keySecret | secureBox | The API key secret to authenticate with AS360. | Yes |
| mailNotification | checkBox | Select this option to notify email IDs configured in AS360. | No |
| reportIssueCountValidation | textBox | Please set the number of issues found (by severity) in a comma-separated list. If the threshold is reached during the scan, the scan will fail. In this field, you can specify the numbers for these severity levels: Critical (C), High (H), Medium (M), Low (L), and Informational (I). For example, a fail condition of '0,0,5,10,20' will cause the step to fail if the resulting scan has more than 0 Critical issues, 0 High issues, 5 Medium issues, and so on. If this field is left empty, there will be no validation of results and the scan will not fail as a result of a fail condition. | No |
| scaConfigFile | textBox | Please point to the path and file name of a scan configuration file. This overrides any scan configuration files which may exist in the scan directory. For example, 'c:\build_output\appscan-config.xml'. | No |
| scaFileLocation | textBox | Please point to the IRX file to be uploaded for scanning, or the directory that contains the files or other locations to scan. The files and locations that can be specified in this field include: .jar files, .war files, .ear files, Eclipse workspaces, and scan configuration files. For example, 'c:\build_output\testapp.irx' or 'c:\build_output'. | Yes |
| scanName | textBox | (Hidden) Enter a name for the scan. If empty, the uploaded file name will be used. | No |
| scanTimeout | textBox | (Hidden) Please enter a timeout for the scan (relevant for only when validating report). The default value of -1 will cause the scan to run until it completes. | No |
| validateSSL | checkBox | Enable TLS certificate validation for the AS360 server. Clear this only for test environments that use self-signed or untrusted certificates. | No |
Stop AS360 Presence
Stop a running AS360 presence. This step must be run on the agent machine on which the presence was originally started.
| Name | Type | Description | Required |
|---|---|---|---|
| baseUrlApp | textBox | Please enter a base AS360 URL. Ex- cloud.appscan.com, cloud.appscan.com/eu. | Yes |
| keyId | textBox | The API key ID to authenticate with AS360. | Yes |
| keySecret | secureBox | The API key secret to authenticate with AS360. | Yes |
| presenceId | textBox | Specify an ID of an existing presence, which allows you to run scans on apps not connected to the internet or require a proxy server to make a connection. The presence must be accessible to the user. | No |
| validateSSL | checkBox | Enable TLS certificate validation for the AS360 server. Clear this only for test environments that use self-signed or untrusted certificates. | No |