Actions for scan sources

This section describes how to add, edit, and delete scan sources, the supported scan sources, and the combinations of scan sources and security tools.

Supported scan sources

The system supports the following scan sources:

• Git Repository;
• Nexus;
• CLI Tool;
• Jfrog;
• Harbor;
• AppUrl.

caution

After you upgrade TRON.ASOC to a new version, you must reconfigure integrations with Git Repository sources that don't have a version control system type configured.

Connect an integration with a scan source

info

To connect integrations with scan sources, users must have at least the following permissions:

• View sources;
• Manage sources;

To connect an integration with a scan source, follow these steps:

1. Go to Integrations → Scan sources.

2. Select Add scan source.

3. Select the access type for the scan source:

   • Global—the scan source will be available in all projects;
   • Project—the scan source will be available only in the selected projects. After you select this access type, select one or more projects where the scan source will be available.
   tip

   When you select the Project access type, you can select the projects where the integration will be available by using checkboxes.

   

4. Select a scan source from the Source drop-down list.

5. Fill in the following fields:

   • name;
   • description;
   • source URL.

6. If necessary, turn on the toggle to skip the connection check before scanning starts.

7. Select Create.

Edit an integration with a scan source

To edit an integration with a scan source, follow these steps:

1. Go to Integrations → Scan sources.
2. Select the more actions button () in the row for the required source.
3. Select Edit.
4. Change the required information.
5. Select Save.

Delete an integration with a scan source

To delete one integration with a scan source, follow these steps:

1. Go to Integrations → Scan sources.
2. Select the more actions button () in the row for the required source.
3. Select Delete.
4. Confirm the source deletion in the window that opens.

To delete multiple integrations with scan sources, follow these steps:

1. Select the scan sources by using checkboxes ()
2. Select the delete button () above the source table.
3. Confirm the source deletion in the window that opens.

Connect an integration with a "Git Repository" scan source

You can connect one or more Git repositories, as well as all repositories within one namespace, as a scan source.

info

The following version control system types are available for a source of type Git Repository:

• GitHub;
• GitLab;
• BitBucket (cloud and server);
• Other (you can connect other types).

When you run scans using a BitBucket source, you can change the specified port, for example: ssh://git@bitbucket.int.tronasoc.ru:0000/test/command.git → https://bitbucket.int.tronasoc.ru:0000/test/command.git.

Consider the following when you connect repositories as scan sources:

• when you connect a namespace, all repositories in it will be added as a source group and synchronized;
• when you connect multiple repositories, the selected repositories will be added as separate sources and won't be grouped together.

Connect an integration with one "Git Repository" scan source

To connect an integration with one Git Repository scan source, follow these steps:

1. Go to Integrations → Scan sources.
2. Select Add scan source.
3. In the window that opens, specify the following information:
   • access type (global/project);
   • source (Git Repository);
   • version control system type;
   • integration type (one repository);
   • repository URL;
   • authentication method and credentials;
   • source name and description.
4. If necessary, turn on the toggle to skip the connection check before scanning starts.
5. Select Create.

Connect an integration with multiple "Git Repository" scan sources

To connect an integration with multiple Git Repository scan sources, follow these steps:

1. Go to Integrations → Scan sources.

2. Select Add scan source.

3. In the window that opens, specify the following information:

   • access type (global/project);
   • source (Git Repository);
   • version control system type;
   • integration type (multiple repositories);
   • organization URL;
   • authentication method and credentials;

4. Specify the parameters:

   • repositories;
   warning

   You can select repositories only if you entered the source authentication credentials correctly.

   • name of each source;
   info

   Each source name will consist of the following parts:

   1. Common prefix (optional).
   2. Repository name.
   • description of each source.

5. If necessary, turn on the toggle to skip the connection check before scanning starts.

6. Select Create.

After you complete all the steps, separate independent integrations will be created for the selected repositories. The integration names will match the repository names.

Connect an integration with a namespace containing repositories

To connect an integration with a namespace containing repositories, follow these steps:

1. Go to Integrations → Scan sources.

2. Select Add scan source.

3. In the window that opens, specify the following information:

   • access type (global/project);
   • source (Git Repository);
   • version control system type;
   • integration type (entire namespace with automatic synchronization);
   • organization URL;
   • authentication method and credentials.

4. Configure the repository synchronization and discovery settings:

   • synchronization period (every N days at HH:MM);
   • name and description of the source group.
   info

   You can also view the repositories automatically discovered in the namespace. To do this, select View discovered repositories.

   Automatic repository discovery is possible only if you entered the source authentication credentials correctly.

5. If necessary, turn on the toggle to skip the connection check before scanning starts.

6. Select Create.

After you complete all the steps, a primary integration will be created. All discovered repositories in the namespace will be linked to it as child integrations.

warning

If necessary, configure restricted access to the repositories in the version control system because child integrations in TRON.ASOC are attached to the parent integration and can't be assigned to different projects within TRON.ASOC.

Combinations of scan sources and security tools

The system supports the following combinations of scan sources and security tools:

1. CLI tools (ESLint, Gitlab SAST, Trivy, Grype, KICS, Aqua, OWASP Dependency Track, Gitleaks) + CLI Custom source.
2. CLI tools that can run in k8s (PVS Studio, Semgrep) + Git Repository. For the current list of CLI tools that can run in k8s, see Run CLI tools in Kubernetes.
3. KCS + Nexus/Harbor/Jfrog.
4. Appscreener Solar SAST/Solar SCA/PTAI + Git Repository.
5. SASTAV + Git Repository.
6. CodeScoring + Git Repository/Nexus/Harbor/Jfrog.
7. Manual tool + CLI Custom source.
8. Appscreener Solar DAST + App URL.

caution

CLI tools from combination 1 can create security checks only with a source type of CLI Custom Source.

When you create a check with combination 2, the tool runs in k8s as a job, receives data from the source, performs the security check, and returns a security issue report.

When you create a security check with combinations 3 and 4, you must also specify the source branch or tag. You can specify multiple branches or tags.

When you create a security check with combination 5, you must also specify the scan rule set and associate the source branch or tag with a commit.

When you create a security check with combination 6, you must also specify the security check type (SCA, container SCA, secrets). If you select the secrets type, you must also select a secrets configuration or upload a new one. You must also specify the source branch or tag. You can specify multiple branches or tags.

The Manual tool type can be combined only with the CLI Custom Source source type because tools of this type support only SARIF report uploads.