Skip to main content
Version: 1.5

Actions with scan sources

This section describes actions for adding, editing, and deleting scan sources, supported scan sources, and combinations of scan sources and security tools.

Supported scan sources​

The system supports the following scan sources:

  • Git Repository;
  • Nexus;
  • CLI Tool;
  • Jfrog;
  • Harbor;
  • AppUrl.
info

The following version control system types are available for a Git repository source:

  • GitHub;
  • GitLab;
  • BitBucket (cloud and server);
  • Other (you can connect other types).

When you start scans with a BitBucket source, you can adjust the specified port (for example: ssh://git@bitbucket.int.tronasoc.ru:0000/test/command.git → https://bitbucket.int.tronasoc.ru:0000/test/command.git).

caution

After you upgrade TRON.ASOC to a new version, you must reconfigure integrations with Git Repository sources that don't have a version control system type configured.

Connect a scan source​

info

To connect scan sources, you must have at least the following permissions:

  • View sources;
  • Manage sources;

To connect a scan source, follow these steps:

  1. Go to Integrations → Scan sources.
  2. Select Add scan source.
  3. Enter values in the Name and Description fields.
  4. Select an access type for the scan source:
    • Global—the scan source will be available in all projects;
    • Project—the scan source will be available only in the selected projects. After you select this access type, select one or more projects where the scan source will be available.
  5. Select a scan source from the Source drop-down list.

Scan sources

  1. Complete the additional fields:

    • Source URL;
    • Authentication method;
    • Skip connection check—the system won't check the connection to the source before starting the scan.

  2. Complete the fields based on the selected authentication method:

    • API token: API token field
    • Login/password: Login and Password fields
    • Anonymous;
    • SSH (a secure SSH key-based authorization method; all SSH methods are available except passphrase).
    info

    Selecting an authentication method isn't required at this step. However, you can't check the connection to the source without specifying an authentication method.

    Scan sources

  3. If needed, check the connection by selecting Check connection.

caution

You can check the connection only if you've entered valid authentication data for the scan source. If the data is correct, the connection check succeeds. If the connection can't be established, verify the data and try again.

  1. Select Create.

Edit a scan source​

To edit a scan source, follow these steps:

  1. Go to Integrations → Scan sources.
  2. Select the additional actions button (Additional actions) in the row for the required source.
  3. Select Edit.
  4. Change the required data.
  5. Select Save.

Delete a scan source​

To delete one scan source, follow these steps:

  1. Go to Integrations → Scan sources.
  2. Select the additional actions button (Additional actions) in the row for the required source.
  3. Select Delete.
  4. Confirm the source deletion in the dialog box.

Confirm deletion of one scan source

To delete multiple scan sources, follow these steps:

  1. Select the scan sources using the checkboxes (Checkbox)
  2. Select the delete button (Delete) above the sources table.
  3. Confirm the source deletion in the dialog box.

Confirm deletion of multiple scan sources

Combinations of scan sources and security tools​

The system supports the following combinations of scan sources and security tools:

  1. CLI tools (ESLint, Gitlab SAST, Trivy, Grype, KICS, Aqua, OWASP Dependency Track, Gitleaks) + CLI Custom source.
  2. CLI tools that can run in k8s + Git Repository. For the current list of CLI tools that can run in k8s, see Run CLI tools in Kubernetes.
  3. KCS + Nexus/Harbor/Jfrog.
  4. Appscreener Solar SAST/Solar SCA/PTAI + Git Repository.
  5. SASTAV + Git Repository.
  6. CodeScoring + Git Repository/Nexus/Harbor/Jfrog.
  7. Manual tool + CLI Custom source.
  8. Appscreener Solar DAST + App URL.
caution

CLI tools from combination 1 can create security checks only with the CLI Custom Source source type.

When you create a check with combination 2, the tool runs in k8s as a job, gets data from the source, performs a security check, and returns a security issue report.

When you create a security check with combinations 3 and 4, you must also specify the source branch or tag. You can specify multiple branches or tags.

When you create a security check with combination 5, you must also specify a scan rule set and associate the source branch or tag with a commit.

When you create a security check with combination 6, you must also specify the security check type (SCA, container SCA, or secrets). If you select secrets, you must also select a secrets configuration or upload a new one. You must also specify the source branch or tag. You can specify multiple branches or tags.

The Manual tool type works only with the CLI Custom Source source type because tools of this type support only SARIF report uploads.