Skip to main content
Version: 1.5.2

Creating a security check

Security check is an entity that combines a scanning tool and a scanning source. It runs security scans and provides scan results.

note

Before adding security checks, make sure the system is integrated with the required scanning sources. See Integrations → Security sources.

If you have system permissions to manage scanning sources, you can add the required sources. For more information, see Scanning sources.

Security check parameters​

Security checks within a layer contain the following data:

  • #—the security check's sequence number;
  • Source—the scanning source name;
  • Tool—the security tool name;
  • Run (Manual/Automatic);
  • Quality checks;
  • Check status—the status of the quality check for an individual check;
info

If a quality check fails, you can find out which metrics caused the failure. Select the Failed status to open the list of quality check metrics.

  • Scan results for an individual check;
  • Security issues for an individual check;
  • Additional actions for the check:
    • Start a new scan;
    • Edit check;
    • Import results;
    • Import SBOM;
    • Delete check;
    • Add security issues manually (available for tools of the Manual type);

Creating a new security check​

To add a security check, follow these steps:

  1. Go to Projects → Project name → Security layers → Project layer.
  2. Select Add if no checks have been added, or select Add security check.
  3. Enter the data in the security check creation form.
info

Keep the following in mind when you fill out the form:

  • Selecting a security tool is required when you configure a security check. You can select only a tool that an administrator previously added in Integrations;
  • form fields depend on the selected Source and Tool fields;
  • you can add multiple source branches/tags when you create a check;
  • for some security tools, you can select the scan run type (manual or automatic), the run frequency, and the scan run time for automatic runs;
  • when you select the Appscreener SAST tool, you can generate and download an API request.

Adding a new security check

  1. Test the connection to the tool by selecting Test connection.
info

You can test the connection only after you correctly enter the authentication data for the security tool. If the data is correct, the connection test succeeds. If the connection can't be established, check the data and try again.

  1. Select Create.
caution

Keep the following in mind when you create a security check:

  • If the system administrator didn't specify an authentication method when creating the integration with the security tool or scanning source, you must enter authentication data when adding the tool or source to the security check, including an API token and username/Password.
  • If you select an authentication method when creating the security check, you must enter authentication data.
  • When you edit the scanning source in an existing security check, the Source branches/tags field appears or is hidden depending on the new source type:
    • If the new source doesn't use branches, the branch field is hidden;
    • If it doesn't use images, the tag field is hidden.