Actions for scan sources

This section describes how to add, edit, and delete scan sources, the supported scan sources, and scan source and security tool combinations.

Supported scan sources

The system supports the following scan sources:

• Git Repository;
• Nexus;
• CLI Tool;
• Jfrog;
• Harbor;
• AppUrl.

caution

After you update TRON.ASOC to a new version, you must reconfigure integrations with Git Repository sources that don't have a version control system type configured.

Connecting an integration to a scan source

info

To connect integrations to scan sources, users must have at least the following permissions:

• View sources;
• Manage sources;

To connect an integration to a scan source, follow these steps:

1. Go to Integrations → Scan sources.

2. Select Add scan source.

3. Select the access type for the scan source:

   • Global—the scan source will be available in all projects;
   • Project—the scan source will be available only in the selected projects. After you select this access type, select one or more projects where the scan source will be available.
   tip

   When you select the Project access type, you can select projects where the integration will be available by using checkboxes.

   

4. Select a scan source from the Source drop-down list.

5. Enter the following fields:

   • name;
   • description;
   • source URL.

6. If necessary, enable the toggle to skip the connection check before scanning starts.

7. Select Create.

Editing an integration for a scan source

To edit an integration for a scan source, follow these steps:

1. Go to Integrations → Scan sources.
2. Select the more actions button () in the row for the required source.
3. Select Edit.
4. Change the required information.
5. Select Save.

Deleting an integration for a scan source

To delete one integration for a scan source, follow these steps:

1. Go to Integrations → Scan sources.
2. Select the more actions button () in the row for the required source.
3. Select Delete.
4. Confirm the source deletion in the dialog box that opens.

To delete multiple integrations for scan sources, follow these steps:

1. Select scan sources by using checkboxes ()
2. Select the delete button () above the source table.
3. Confirm the source deletions in the dialog box that opens.

Connecting an integration to a scan source of type "Git Repository"

You can connect one or more Git repositories, as well as all repositories in a namespace, as scan sources.

info

The following version control system types are available for a source of type Git Repository:

• GitHub;
• GitLab;
• BitBucket (cloud and server);
• Other (you can connect other types).

When you start scans using a BitBucket source, you can adjust the specified port (for example: ssh://git@bitbucket.int.tronasoc.ru:0000/test/command.git → https://bitbucket.int.tronasoc.ru:0000/test/command.git).

Keep the following in mind when you connect repositories as scan sources:

• when you connect a namespace, all repositories in it will be added as a source group and synchronized;
• when you connect multiple repositories, the selected repositories will be added as separate sources and won't be grouped together.

Connecting an integration to one scan source of type "Git Repository"

To connect an integration to one scan source of type Git Repository, follow these steps:

1. Go to Integrations → Scan sources.
2. Select Add scan source.
3. In the source addition window that opens, enter the following information:
   • access type (global/project);
   • source (Git Repository);
   • version control system type;
   • integration type (one repository);
   • repository URL;
   • authentication method and credentials;
   • source name and description.
4. If necessary, enable the toggle to skip the connection check before scanning starts.
5. Select Create.

Connecting an integration to multiple scan sources of type "Git Repository"

To connect an integration to multiple scan sources of type Git Repository, follow these steps:

1. Go to Integrations → Scan sources.

2. Select Add scan source.

3. In the source addition window that opens, enter the following information:

   • access type (global/project);
   • source (Git Repository);
   • version control system type;
   • integration type (multiple repositories);
   • organization URL;
   • authentication method and credentials;

4. Specify the following parameters:

   • repositories;
   warning

   You can select repositories only if you entered the source authentication credentials correctly.

   • name of each source;
   info

   Each source name consists of the following parts:

   1. Common prefix (optional).
   2. Repository name.
   • description of each source.

5. If necessary, enable the toggle to skip the connection check before scanning starts.

6. Select Create.

After you complete all the steps, separate, independent integrations will be created for the selected repositories. The integration names will match the repository names.

Connecting an integration to a namespace with repositories

To connect an integration to a namespace with repositories, follow these steps:

1. Go to Integrations → Scan sources.

2. Select Add scan source.

3. In the source addition window that opens, enter the following information:

   • access type (global/project);
   • source (Git Repository);
   • version control system type;
   • integration type (full namespace with automatic synchronization);
   • organization URL;
   • authentication method and credentials.

4. Configure repository synchronization and discovery settings:

   • synchronization interval (every N days at HH:MM);
   • source group name and description.
   info

   You can also view repositories discovered automatically in the namespace. To do this, select View discovered repositories.

   Automatic repository discovery is possible only if you entered the source authentication credentials correctly.

5. If necessary, enable the toggle to skip the connection check before scanning starts.

6. Select Create.

After you complete all the steps, the main integration will be created. All discovered repositories from the namespace will be linked to it as child integrations.

warning

If necessary, configure restricted repository access in the version control system because child integrations in TRON.ASOC are attached to the parent integration and can't be assigned to different projects within TRON.ASOC.

Scan source and security tool combinations

The system supports the following scan source and security tool combinations:

1. CLI tools (ESLint, Gitlab SAST, Trivy, Grype, KICS, Aqua, OWASP Dependency Track, Gitleaks) + CLI Custom source.
2. CLI tools that can run in k8s (PVS Studio, Semgrep) + Git Repository. For the current list of CLI tools that can run in k8s, see Running CLI tools in Kubernetes.
3. KCS + Nexus/Harbor/Jfrog.
4. Appscreener Solar SAST/Solar SCA/PTAI + Git Repository.
5. SASTAV + Git Repository.
6. CodeScoring + Git Repository/Nexus/Harbor/Jfrog.
7. Manual tool + CLI Custom source.
8. Appscreener Solar DAST + App URL.

caution

CLI tools from combination 1 can create security checks only with a source type of CLI Custom Source.

When you create a check with combination 2, the tool runs in k8s as a job, gets data from the source, performs the security check, and returns a security issue report.

When you create a security check with combinations 3 and 4, you must also specify the source branch or tag. You can specify multiple branches or tags.

When you create a security check with combination 5, you must also specify the scan rule set and associate the source branch or tag with a commit.

When you create a security check with combination 6, you must also specify the security check type (SCA, container SCA, secrets). If you select the secrets type, you must also select a secrets configuration or upload a new one. You must also specify the source branch or tag. You can specify multiple branches or tags.

The Manual tool type can be combined only with the CLI Custom Source source type because tools of this type support only SARIF report uploads.