Actions with security tools

This section describes how to add, edit, and delete integrations with security tools, the available security tools and their versions, considerations for working with SASTAV, and examples of integrations with security tools.

Available tools and their versions

The current system version supports the following security tools. See the table below.

Tool	Version
PT Application Inspector	5.0
Kaspersky Container Security	2.3
Solar AppScreener	3.15.5
Aqua	2022.4.759
CodeScoring	2025.29.3
Grype	0.106.0
KICS	2.1.19
OWASP Dependency Track	4.12.1
Trivy	0.68
Semgrep	1.146.0
ESLint	9.39.2
PVS-Studio	7.38
GitLab Advanced SAST	3.0.0
AppSec.Sting	2025.5
AppSec.Track	3.19
Gitleaks	8.30.0
SASTAV	2.4.0

note

When you create a security check with Solar AppScreener, you can select the analysis type: SAST, DAST, or SCA.

Considerations for working with SASTAV

Keep the following points in mind when working with SASTAV:

1. When you authenticate, use a SASTAV service account to configure the SASTAV integration.
2. SASTAV repositories must be unique across all system projects. When you create security checks with identical scan sources in different projects, SASTAV creates only one repository.
3. SASTAV scan results from the shared repository appear in the corresponding security checks and projects during report parsing.
4. When you edit a security check, you can select the repository type:
   • Basic—limits the number of lines of code to 15,000;
   • Extended—limits the number of lines of code to 1 million. This value is set by default.

5. Due to technical limitations on the number of SASTAV repositories, TRON ASOC lets you specify the maximum number of repositories. To do this, use the Maximum number of repositories parameter in the SASTAV integration settings. When you specify a numeric value, the system monitors the number of active repositories. If you don't specify a value, the system applies the maximum limit available under the SASTAV license.

6. You can also clean up SASTAV repositories created by TRON ASOC. You can clean up repositories manually or automatically. For example, when you delete a security check, TRON ASOC deletes the associated SASTAV repository if no other security checks use it.

Connecting an integration with a security tool

info

To configure integrations with security tools, a user must have at least the following permissions:

• View tools;
• Manage tools.

To add a new integration with a security tool, follow these steps:

1. Go to Integrations → Security tools.
2. Select Add security tool.
3. Select the required security tool from the list of integrations.

4. Fill in the required Name and Description fields.

5. Select the tool access type:

   • Global—the integration is available in all projects;
   • Project—the integration is available only in the selected projects. After you select this access type, also select one or more projects where the integration will be available.

6. Fill in the additional fields:

   • Tool description;
   • URL;
   • Scan result language;
   • Authentication method.
   info

   The set of additional fields depends on the selected security tool.

   You don't have to select an authentication method at this step. However, you can't test the connection to the tool without specifying an authentication method.

7. Fill in the fields based on the selected authentication method:

   • API token: API token field
   • Login/password: Login and Password fields
   • None. If you select the None authentication method, scanning isn't available, but you can manually import scan results.
   note

   Some tools also provide additional settings based on data received from the tool integration, such as license verification data and tool limitations. For CodeScoring, you can use existing authentication data. The integration settings also include additional parameters.

8. If necessary, test the connection by selecting Test connection.

caution

You can test the connection only with the API token and Login/password authentication methods.

You can test the connection only after you correctly enter the authentication data for the security tool. If you enter the data correctly, the connection test succeeds. If the connection isn't established, check the data and try again.

9. Select Create.

Editing an integration with a security tool

To edit an integration with a security tool, follow these steps:

1. Select the edit button () in the tool row.
2. In the form that opens, change the required parameters.
3. Select Save.

Deleting an integration with a security tool

To delete an integration with a security tool, follow these steps:

1. Select the delete button in the tool row.
2. Confirm the tool deletion in the modal window.

To delete multiple integrations with security tools, follow these steps:

1. Select the tools using the checkboxes ().
2. Select the delete button () above the tools table.
3. Confirm the tool deletions in the modal window.

Examples of integrations with security tools

Adding an integration with PT Application Inspector

To add an integration with the tool to the system, follow these steps:

1. Go to Integrations → Security tools.

2. Select Add security tool.

3. Select PT Application Inspector from the list of tools.

4. Fill in the fields in the form that opens:

   • Integration name—the name must be unique;
   • Description.

5. Configure the connection parameters:

   • API URL (for example, https://your.company.ptsecurity/api/v1);
   • Scan result language;
   • Authentication method.
   info

   You can specify the authentication method later when you add a security check.

6. Select Test connection.

caution

You can test the connection only after you correctly enter the authentication data for the security tool. If you enter the data correctly, the connection test succeeds. If the connection isn't established, check the data and try again.

6. Select Save.

Adding an integration with Kaspersky Container Security (KCS)

To add an integration with the tool to the system, follow these steps:

1. Go to Integrations → Security tools.

2. Select Add security tool.

3. Select Kaspersky Container Security from the list of tools.

4. Fill in the required fields:

   • Name;
   • Description.

5. Configure the connection parameters:

   • URL;
   • Scan result language;
   • Authentication method (API token).
   info

   You can specify the authentication method later when you add a security check.

6. Add the API token to the API token field.

7. Select Test connection.

caution

You can test the connection only after you correctly enter the authentication data for the security tool. If you enter the data correctly, the connection test succeeds. If the connection isn't established, check the data and try again.

7. Select Save.