Working with security tools

This section describes how to add, edit, and delete integrations with security tools, lists the available security tools and their versions, explains how to work with SASTAV, and provides examples of integrations with security tools.

Available tools and their versions

The current system version supports the following security tools:

Tool	Version
PT Application Inspector	5.0
Kaspersky Container Security	2.3
Solar AppScreener	3.15.5
Aqua	2022.4.759
CodeScoring	2025.29.3
Grype	0.106.0
KICS	2.1.19
OWASP Dependency Track	4.12.1
Trivy	0.68
Semgrep	1.146.0
ESLint	9.39.2
PVS-Studio	7.38
GitLab Advanced SAST	3.0.0
AppSec.Sting	2025.5
AppSec.Track	3.19
Gitleaks	8.30.0
SASTAV	2.4.0

note

When you create a security check with Solar AppScreener, you can select the analysis type (SAST, DAST, or SCA).

Working with SASTAV

Keep the following points in mind when you work with SASTAV:

1. When you authenticate while configuring the SASTAV integration, you must use a SASTAV service account.
2. SASTAV repositories must be unique across all system projects. If you create security checks with identical scan sources in different projects, SASTAV creates only one repository.
3. SASTAV scan results appear in the corresponding security checks and projects during report parsing.
4. When you edit a security check, you can select the repository type:
   • Basic—supports up to 15,000 lines of code;
   • Advanced—supports up to 1 million lines of code. This value is set by default.

5. Because of technical limits on the number of SASTAV repositories, TRON ASOC lets you specify the maximum number of repositories. To do this, use the Maximum number of repositories parameter in the SASTAV integration settings. When you enter a numeric value, the system monitors the number of active repositories. If you don't specify a value, the system applies the maximum limit available under your SASTAV license.

6. You can also clean up SASTAV repositories created by TRON ASOC. You can clean up repositories manually or automatically. For example, when you delete a security check, TRON ASOC deletes the associated SASTAV repository if no other security checks use it.

Connect a security tool integration

info

To configure integrations with security tools, users must have at least the following permissions:

• View tools;
• Manage tools.

To add a new security tool integration, follow these steps:

1. Go to Integrations → Security tools.
2. Select Add security tool.
3. Select the required security tool from the list of integrations.

4. Fill in the required Name and Description fields.

5. Select the access type for the tool:

   • Global—the integration is available in all projects;
   • Project—the integration is available only in the selected projects. After you select this access type, select one or more projects where the integration will be available.

6. Fill in the additional fields:

   • Tool description;
   • URL;
   • Scan result language;
   • Authentication method.
   info

   The additional fields depend on the selected security tool.

   You don't have to select an authentication method at this step, but you can't test the connection without specifying one.

7. Fill in the fields based on the selected authentication method:

   • API token: API token field
   • Login/password: Login and Password fields
   • None. If you select the None authentication method, scanning isn't available, but users can manually import scan results.
   note

   Some tools also support additional settings based on data received from the tool integration, such as license information and tool limitations. CodeScoring can use existing authentication data and supports additional integration settings.

8. If necessary, test the connection by selecting Test connection.

caution

You can test the connection only with the API token and Login/password authentication methods.

You can test the connection only if you've entered the security tool's authentication data correctly. If the data is correct, the connection test succeeds. If the connection fails, verify the data and try again.

9. Select Create

Edit a security tool integration

To edit a security tool integration, follow these steps:

1. Select the edit button () in the tool row.
2. Change the required settings in the form that opens.
3. Select Save

Delete a security tool integration

To delete a security tool integration, follow these steps:

1. Select the delete button in the tool row.
2. Confirm the tool deletion in the modal window that opens.

To delete multiple security tool integrations, follow these steps:

1. Select the tools using the checkboxes ()
2. Select the delete button () above the tools table.
3. Confirm the tool deletions in the modal window that opens.

Examples of integrations with security tools

Add an integration with PT Application Inspector

To add an integration with the tool to the system, follow these steps:

1. Go to Integrations → Security tools.

2. Select Add security tool.

3. Select PT Application Inspector from the list of tools.

4. Fill in the fields in the form that opens:

   • Integration name—the name must be unique;
   • Description.

5. Configure the connection settings:

   • API URL (for example, https://your.company.ptsecurity/api/v1);
   • Scan result language;
   • Authentication method.
   info

   You can specify the authentication method later when you add a security check.

6. Select Test connection.

caution

You can test the connection only if you've entered the security tool's authentication data correctly. If the data is correct, the connection test succeeds. If the connection fails, verify the data and try again.

6. Select Save.

Add an integration with Kaspersky Container Security (KCS)

To add an integration with the tool to the system, follow these steps:

1. Go to Integrations → Security tools.

2. Select Add security tool.

3. Select Kaspersky Container Security from the list of tools.

4. Fill in the required fields:

   • Name;
   • Description.

5. Configure the connection settings:

   • URL;
   • Scan result language;
   • Authentication method (API token).
   info

   You can specify the authentication method later when you add a security check.

6. Add an API token to the API token field.

7. Select Test connection.

caution

You can test the connection only if you've entered the security tool's authentication data correctly. If the data is correct, the connection test succeeds. If the connection fails, verify the data and try again.

7. Select Save.