Skip to main content
Version: 1.6.1

Quick start

Use this guide to complete the user journey in TRON.ASOC and perform the following actions:

  • log in to the system;
  • create your first project;
  • configure a security check;
  • start a scan;
  • view scan results.
info

This guide is intended for users who already have an account in TRON.ASOC. If you haven't installed the system yet, start with the Installation and first login section.

Before you start​

Make sure you meet the following requirements:

  • you have the system login link, Username, and Password for your account (request them from your system administrator);
  • your role has permission to create projects and security checks;
  • your administrator has configured an integration with at least one scan source, for example, a repository, and a security tool in the Integrations section. For more information about configuring integrations, see the Integrations section.

Step 1. Log in​

To log in to the system, follow these steps:

  1. Go to the login page using the link you received from your administrator.
  2. Enter the Username and Password for your account.
  3. Select Login.
note

When you log in for the first time, the system prompts you to change your password. Your new password must meet the password requirements set by your administrator.

After you log in, the Dashboard home page opens with overall project statistics.

Step 2. Create a project​

A project is a top-level entity that combines the layers, security checks, and scan results for one product or service.

To create a project, follow these steps:

  1. Go to the Projects section.
  2. Select Add project.
  3. Enter the project code, name, Description, and Tags.
  4. Select Create.

For more information, see Create a project.

Step 3. Add a project layer​

A project layer (pipeline) is an entity that groups security checks, for example, by environment, service, or container.

To add a project layer, follow these steps:

  1. Open the project overview page and go to the Project layer tab.
  2. Select Add layer.
  3. Select From scratch or From template if you already have a configured template.
  4. Enter the name, Description, Layer type, and, if needed, associate a quality gate.
  5. Select Create.
tip

If you already have a configured layer template for similar projects, creating a layer from a template saves time because most parameters are filled in automatically.

For more information, see Create a layer from scratch and Create a layer from a template.

Step 4. Add a security check​

A security check combines a scanning tool, for example, a SAST or SCA tool, with a scan source, for example, a repository. It starts the scan and returns the results.

To add a security check, follow these steps:

  1. In the project layer, select Add security check.
  2. Select a scan source and security tool from the integrations configured earlier.
  3. Complete the remaining form fields—the fields depend on the selected source and tool.
  4. Test the connection to the tool by selecting Test connection.
  5. Select Create.
warning

You must select the scan source and tool from the integrations configured by your administrator. If you need to add new integrations with sources or tools, contact your TRON.ASOC administrator.

For more information, see Create a security check.

Step 5. Start a scan​

You can start one security check or all checks in a layer:

  1. To start all security checks in the layer, select Start a new scan on the project layer page. To start only one check, select the additional actions button in its row and select Start a new scan.
  2. Wait for the check status to change from Scanning to Completed.

For more information, see Start a security check.

Step 6. View scan results​

After the scan finishes, you can view the results in several sections:

  • Dashboard—summary statistics and widgets for all projects. For more information, see the Dashboard section.
  • Project report—a summary or detailed report for a specific project. For more information, see the Project report section.
  • Security issues—a list of detected vulnerabilities with filters for severity, status, tool, and other parameters. For more information, see the Security issues section.

You can process detected issues by changing their status, assigning an owner, leaving a comment, or marking them as false positives. For more information, see Process security issues.

What’s next?​