Actions with security tools

This section describes how to add, edit, and delete integrations with security tools, lists the available security tools and their versions, explains how to work with SASTAV, and provides examples of integrations with security tools.

Available tools and their versions

The current system version supports the following security tools (see the table below).

Tool	Version
PT Application Inspector	5.0
Kaspersky Container Security	2.3
Solar AppScreener	3.15.5
Aqua	2022.4.759
CodeScoring	2025.29.3
Grype	0.106.0
KICS	2.1.19
OWASP Dependency Track	4.12.1
Trivy	0.68
Semgrep	1.146.0
ESLint	9.39.2
PVS-Studio	7.38
GitLab Advanced SAST	3.0.0
AppSec.Sting	2025.5
AppSec.Track	3.19
Gitleaks	8.30.0
SASTAV	2.4.0

note

When you create a security check with Solar AppScreener, you can select the analysis type (SAST, DAST, or SCA).

Working with SASTAV

Keep the following points in mind when you work with SASTAV:

1. When you authenticate, use a SASTAV service account when you configure the SASTAV integration.
2. SASTAV repositories must be unique across all system projects. If you create security checks with identical scan sources in different projects, SASTAV creates only one repository.
3. SASTAV scan results appear in the corresponding security checks and projects during report parsing.
4. When you edit a security check, you can select the repository type:
   • Basic—limited to 15,000 lines of code;
   • Advanced—limited to 1 million lines of code. This value is set by default.

5. Because of technical limits on the number of SASTAV repositories, TRON ASOC lets you specify the maximum number of repositories. To do this, use the Maximum number of repositories setting in the SASTAV integration settings. When you enter a numeric value, the system controls the number of active repositories. If you don't specify a value, the system applies the maximum limit available under the SASTAV license.

6. You can also clean up SASTAV repositories created by TRON ASOC. You can clean up repositories manually or automatically. For example, when you delete a security check, TRON ASOC deletes the associated SASTAV repository if no other security checks in TRON ASOC use it.

Connecting a security tool integration

info

To configure integrations with security tools, the user must have at least the following permissions:

• View tools;
• Manage tools.

To add a new security tool integration, follow these steps:

1. Go to Integrations → Security tools.
2. Select Add security tool.
3. Select the required security tool from the list of integrations.

4. Fill in the required Name and Description fields.

5. Select the access type for the tool:

   • Global—the integration is available in all projects;
   • Project—the integration is available only in selected projects. After you select this access type, select one or more projects where the integration will be available.

6. Fill in the additional fields:

   • Tool description;
   • URL;
   • Scan result language;
   • Authentication method.
   info

   The set of additional fields depends on the selected security tool.

   Selecting an authentication method isn't required at this step. However, you can't test the connection to the tool without specifying an authentication method.

7. Fill in the fields based on the selected authentication method:

   • API token: API token field
   • Login/password: Login and Password fields
   • None. If you select the None authentication method, scanning isn't available, but the user can manually import scan results.
   note

   Some tools also provide additional settings based on data retrieved from the tool integration, such as license verification data and tool limitations. For CodeScoring, you can use existing authentication data. The integration settings also include additional parameters.

8. If necessary, test the connection by selecting Test connection.

caution

You can test the connection only with the API token and Login/password authentication methods.

You can test the connection only after you correctly enter the authentication data for the security tool. If the data is correct, the connection test succeeds. If the connection fails, check the data and try again.

9. Select Create

Editing a security tool integration

To edit a security tool integration, follow these steps:

1. Select the edit button () in the tool row.
2. Change the required settings in the form that opens.
3. Select Save

Deleting a security tool integration

To delete a security tool integration, follow these steps:

1. Select the delete button in the tool row.
2. Confirm the tool deletion in the modal window that opens.

To delete multiple security tool integrations, follow these steps:

1. Select the tools using the checkboxes ().
2. Select the delete button () above the tools table.
3. Confirm the tool deletions in the modal window that opens.

Examples of integrations with security tools

Adding an integration with PT Application Inspector

To add an integration with the tool to the system, follow these steps:

1. Go to Integrations → Security tools.

2. Select Add security tool.

3. Select PT Application Inspector from the list of tools.

4. Fill in the fields in the form that opens:

   • Integration name—the name must be unique;
   • Description.

5. Configure the connection settings:

   • API URL (for example, https://your.company.ptsecurity/api/v1);
   • Scan result language;
   • Authentication method.
   info

   You can specify the authentication method later when you add a security check.

6. Select Test connection.

caution

You can test the connection only after you correctly enter the authentication data for the security tool. If the data is correct, the connection test succeeds. If the connection fails, check the data and try again.

6. Select Save.

Adding an integration with Kaspersky Container Security (KCS)

To add an integration with the tool to the system, follow these steps:

1. Go to Integrations → Security tools.

2. Select Add security tool.

3. Select Kaspersky Container Security from the list of tools.

4. Fill in the required fields:

   • Name;
   • Description.

5. Configure the connection settings:

   • URL;
   • Scan result language;
   • Authentication method (API token).
   info

   You can specify the authentication method later when you add a security check.

6. Enter the API token in the API token field.

7. Select Test connection.

caution

You can test the connection only after you correctly enter the authentication data for the security tool. If the data is correct, the connection test succeeds. If the connection fails, check the data and try again.

7. Select Save.