Skip to main content
Version: 1.5.1

Creating a security check

A security check is an entity that combines a scanning tool and a scan source. You use it to run security scans and get scan results.

note

Before you add security checks, make sure the system has an integration with the required scan sources (see Integrations → Security sources).

If you have system permissions to manage scan sources, you can add the required sources. For more information, see Scan sources.

Security check parameters​

Security checks within a layer contain the following data:

  • #—the security check's sequence number;
  • Source—the scan source name;
  • Tool—the security tool name;
  • Run (Manual/Automatic);
  • Quality controls;
  • Check status—the quality control status for an individual check;
info

If a quality control fails, you can find out which metrics caused the failure. To do this, select the Failed status. A window opens with a list of quality control metrics.

  • Scan results for an individual check;
  • Security issues for an individual check;
  • Additional actions for the check:
    • Start a new scan;
    • Edit check;
    • Import results;
    • Import SBOM;
    • Delete check;
    • Add security issues manually (available for tools of the Manual type);

Creating a new security check​

To add a security check, follow these steps:

  1. Go to Projects → Project name → Security layers → Project layer.
  2. Select Add (if no checks have been added) or Add security check.
  3. Enter the data in the security check creation form.
info

Keep the following in mind when you fill out the form:

  • When you configure a security check, selecting a security tool is required. You can select only a tool that an administrator previously added in the Integrations section.
  • The form fields depend on the selected Source and Tool fields.
  • When you create a check, you can add multiple source branches or tags.
  • For some security tools, you can select the scan run type (manual or automatic), the run frequency, and the scan run time for automatic runs.
  • When you select the Appscreener SAST tool, you can generate and download an API request.

Adding a new security check

  1. Check the connection to the tool by selecting Check connection.
info

You can check the connection only after you've entered the authentication information for the security tool correctly. If the information is correct, the connection check succeeds. If the connection isn't established, check the information and try again.

  1. Select Create.
caution

Keep the following in mind when you create a security check:

  • If the system administrator didn't specify an authentication method when creating the integration with the security tool or scan source, you must enter authentication information when adding the tool or source to the security check (API token, username, or Password).
  • If you select an authentication method when creating a security check, you must enter authentication information.
  • When you edit a scan source in an existing security check, the Source branches/tags field appears or disappears depending on the type of the new source:
    • If the new source doesn't use branches, the branch field is hidden.
    • If it doesn't use images, the tag field is hidden.