Skip to main content
Version: 1.5.2

Actions for scanning sources

This section describes how to add, edit, and delete scanning sources, supported scanning sources, and scanning source and security tool combinations.

Supported scanning sources​

The system supports the following scanning sources:

  • Git Repository;
  • Nexus;
  • CLI Tool;
  • Jfrog;
  • Harbor;
  • AppUrl.
info

For Git repository sources, the following version control systems are available:

  • GitHub;
  • GitLab;
  • BitBucket (cloud and server);
  • Other (you can connect other types).

When you start scans using a BitBucket source, you can modify the specified port (for example: ssh://git@bitbucket.int.tronasoc.ru:0000/test/command.git → https://bitbucket.int.tronasoc.ru:0000/test/command.git).

caution

After you upgrade TRON.ASOC to a new version, you must reconfigure integrations with Git Repository sources that don't have a version control system configured.

Connect a scanning source​

info

To connect scanning sources, users must have at least the following permissions:

  • View sources;
  • Manage sources;

To connect a scanning source, follow these steps:

  1. Go to Integrations → Scanning sources.
  2. Select Add scanning source.
  3. Enter values in the Name and Description fields.
  4. Select the access type for the scanning source:
    • Global—the scanning source will be available in all projects;
    • Project—the scanning source will be available only in selected projects. After you select this access type, select one or more projects where the scanning source will be available.
  5. Select a scanning source from the Source drop-down list.

Scanning sources

  1. Enter values in the following additional fields:

    • Source URL;
    • Authentication method;
    • Skip connection check—the system won't check the connection to the source before starting the scan.

  2. Enter values in the fields based on the selected authentication method:

    • API token: API Token field
    • Login/password: Login and Password fields
    • Anonymous;
    • SSH (a secure SSH key authorization method; all SSH keys except passphrase are available).
    info

    You don't have to select an authentication method at this step. However, you can't check the connection to the source without specifying an authentication method.

    Scanning sources

  3. If necessary, check the connection by selecting Check connection.

caution

You can check the connection only if you've entered the source's authentication information correctly. If the information is correct, the connection check succeeds. If the connection isn't established, verify the information and try again.

  1. Select Create.

Edit a scanning source​

To edit a scanning source, follow these steps:

  1. Go to Integrations → Scanning sources.
  2. Select the additional actions button (Additional actions) in the row for the required source.
  3. Select Edit.
  4. Edit the required information.
  5. Select Save.

Delete a scanning source​

To delete one scanning source, follow these steps:

  1. Go to Integrations → Scanning sources.
  2. Select the additional actions button (Additional actions) in the row for the required source.
  3. Select Delete.
  4. Confirm the source deletion in the window that opens.

Confirm deletion of one scanning source

To delete multiple scanning sources, follow these steps:

  1. Select the scanning sources using the checkboxes (Checkbox)
  2. Select the delete button (Delete) above the sources table.
  3. Confirm the source deletions in the window that opens.

Confirm deletion of multiple scanning sources

Scanning source and security tool combinations​

The system supports the following scanning source and security tool combinations:

  1. CLI tools (ESLint, Gitlab SAST, Trivy, Grype, KICS, Aqua, OWASP Dependency Track, Gitleaks) + CLI Custom source.
  2. CLI tools that can run in k8s + Git Repository. For the current list of CLI tools that can run in k8s, see Run CLI tools in Kubernetes.
  3. KCS + Nexus/Harbor/Jfrog.
  4. Appscreener Solar SAST/Solar SCA/PTAI + Git Repository.
  5. SASTAV + Git Repository.
  6. CodeScoring + Git Repository/Nexus/Harbor/Jfrog.
  7. Manual tool + CLI Custom source.
  8. Appscreener Solar DAST + App URL.
caution

CLI tools from combination 1 can create security checks only with the CLI Custom Source source type.

When you create a check with combination 2, the tool runs in k8s as a job, gets data from the source, performs the security check, and returns a security issue report.

When you create a security check with combinations 3 and 4, you must also specify the source branch or tag. You can specify multiple branches or tags.

When you create a security check with combination 5, you must also specify a scan rule set and associate the source branch or tag with a commit.

When you create a security check with combination 6, you must also specify the security check type (SCA, container SCA, or secrets). If you select secrets, you must also select a secrets configuration or upload a new one. You must also specify the source branch or tag. You can specify multiple branches or tags.

The Manual tool type can be combined only with the CLI Custom Source source type because tools of this type support only SARIF report uploads.