Skip to main content
Version: 1.5.1

Actions for scan sources

This section describes how to add, edit, and delete scan sources, supported scan sources, and combinations of scan sources and security tools.

Supported scan sources​

The system supports the following scan sources:

  • Git Repository;
  • Nexus;
  • CLI Tool;
  • Jfrog;
  • Harbor;
  • AppUrl.
info

The following version control system types are available for Git repository sources:

  • GitHub;
  • GitLab;
  • BitBucket (cloud and server);
  • Other (you can connect other types).

When you run scans using a BitBucket source, you can adjust the specified port (for example: ssh://git@bitbucket.int.tronasoc.ru:0000/test/command.git → https://bitbucket.int.tronasoc.ru:0000/test/command.git).

caution

After you update TRON.ASOC to a new version, you must reconfigure integrations with Git Repository sources that don't have a version control system type configured.

Connecting a scan source​

info

To connect a scan source, you must have at least the following permissions:

  • View sources;
  • Manage sources;

To connect a scan source, follow these steps:

  1. Go to Integrations → Scan sources.
  2. Select Add scan source.
  3. Fill in the Name and Description fields.
  4. Select the access type for the scan source:
    • Global—the scan source will be available in all projects;
    • Project—the scan source will be available only in the selected projects. After you select this access type, select one or more projects where the scan source will be available.
  5. Select a scan source from the Source drop-down list.

Scan sources

  1. Fill in the additional fields:

    • Source URL;
    • Authentication method;
    • Skip connection check—the system won't check the connection to the source before it starts the scan.

  2. Fill in the fields based on the selected authentication method:

    • API token: API token field
    • Username/password: Username and Password fields
    • Anonymous;
    • SSH (a secure SSH key authentication method; all SSH keys except passphrase are available).
    info

    You don't have to select an authentication method at this step. However, you can't check the connection to the source without specifying an authentication method.

    Scan sources

  3. If necessary, check the connection by selecting Check connection.

caution

You can check the connection only if you've entered the correct authentication information for the scan source. If the information is correct, the connection check succeeds. If the connection isn't established, verify the information and try again.

  1. Select Create.

Editing a scan source​

To edit a scan source, follow these steps:

  1. Go to Integrations → Scan sources.
  2. Select the additional actions button (Additional actions) in the row for the required source.
  3. Select Edit.
  4. Change the required information.
  5. Select Save.

Deleting a scan source​

To delete one scan source, follow these steps:

  1. Go to Integrations → Scan sources.
  2. Select the additional actions button (Additional actions) in the row for the required source.
  3. Select Delete.
  4. Confirm the deletion in the dialog box.

Confirmation for deleting one scan source

To delete multiple scan sources, follow these steps:

  1. Select the scan sources using the checkboxes (Checkbox)
  2. Select the delete button (Delete) above the source table.
  3. Confirm the deletion in the dialog box.

Confirmation for deleting multiple scan sources

Combinations of scan sources and security tools​

The system supports the following combinations of scan sources and security tools:

  1. CLI tools (ESLint, Gitlab SAST, Trivy, Grype, KICS, Aqua, OWASP Dependency Track, Gitleaks) + CLI Custom source.
  2. CLI tools that can run in k8s + Git Repository. For the current list of CLI tools that can run in k8s, see Running CLI tools in Kubernetes.
  3. KCS + Nexus/Harbor/Jfrog.
  4. Appscreener Solar SAST/Solar SCA/PTAI + Git Repository.
  5. SASTAV + Git Repository.
  6. CodeScoring + Git Repository/Nexus/Harbor/Jfrog.
  7. Manual tool + CLI Custom source.
  8. Appscreener Solar DAST + App URL.
caution

CLI tools from combination 1 can create security checks only with the CLI Custom Source source type.

When you create a check with combination 2, the tool runs in k8s as a job, receives data from the source, performs a security check, and returns a security issue report.

When you create a security check with combinations 3 and 4, you must also specify the source branch or tag. You can specify multiple branches or tags.

When you create a security check with combination 5, you must also specify a scan ruleset and link the source branch or tag to a commit.

When you create a security check with combination 6, you must also specify the security check type (SCA, container SCA, secrets). If you select secrets, you must also select a secrets configuration or upload a new one. You must also specify the source branch or tag. You can specify multiple branches or tags.

The Manual tool type can be combined only with the CLI Custom Source source type because tools of this type support only SARIF report uploads.