Skip to main content
Version: 1.6

Quick start

Use this guide to complete the user journey in TRON.ASOC and perform the following actions:

  • log in to the system;
  • create your first project;
  • configure a security check;
  • start a scan;
  • view scan results.
info

This guide is intended for users who already have an account in TRON.ASOC. If you haven't installed the system yet, start with the Installation and first login section.

Before you start​

Make sure you meet the following requirements:

  • you have the system login link, Username, and Password for your account (ask your system administrator);
  • your role has permission to create projects and security checks;
  • your administrator has configured an integration with at least one scan source (for example, a repository) and a security tool in the Integrations section. For more information about configuring integrations, see the Integrations section.

Step 1. Log in​

Follow these steps to log in:

  1. Go to the login page using the link you received from your administrator.
  2. Enter your account Username and Password.
  3. Select Login.
note

When you log in for the first time, the system prompts you to change your password. Your new password must meet the password requirements set by your administrator.

After you log in, the Dashboard home page opens with overall project statistics.

Step 2. Create a project​

A project is a top-level entity that combines the layers, security checks, and scan results for a single product or service.

Follow these steps to create a project:

  1. Go to the Projects section.
  2. Select Add project.
  3. Enter the project code, name, description, and tags.
  4. Select Create.

For more information, see Create a project.

Step 3. Add a project layer​

A project layer (pipeline) is an entity that groups security checks, for example, by environment, service, or container.

Follow these steps to add a project layer:

  1. Open the project overview page and go to the Project layer tab.
  2. Select Add layer.
  3. Select From scratch or From template if you've already configured a template.
  4. Enter the name, description, and layer type, and optionally link a quality gate.
  5. Select Create.
tip

If you've already configured a layer template for similar projects, creating a layer from a template saves time—most parameters are filled in automatically.

For more information, see Create a layer from scratch and Create a layer from a template.

Step 4. Add a security check​

A security check combines a scanning tool (for example, a SAST or SCA tool) and a scan source (for example, a repository). It starts the scan and returns the results.

Follow these steps to add a security check:

  1. In the project layer, select Add security check.
  2. Select a scan source and security tool from the integrations that were configured earlier.
  3. Complete the remaining form fields—the fields depend on the selected source and tool.
  4. Test the connection to the tool by selecting Test connection.
  5. Select Create.
warning

You must select the scan source and tool from the integrations configured by your administrator. If you need to add new integrations with sources or tools, contact your TRON.ASOC administrator.

For more information, see Create a security check.

Step 5. Start a scan​

You can start one security check or all checks in a layer:

  1. To start all security checks in a layer, select Start new scan on the project layer page. To start only one check, select the additional actions button in its row, and select Start new scan.
  2. Wait for the check status to change from Scanning to Done.

For more information, see Start a security check.

Step 6. View scan results​

After the scan finishes, the results are available in several sections:

  • Dashboard—summary statistics and widgets for all projects. For more information, see the Dashboard section.
  • Project report—a summary or detailed report for a specific project. For more information, see the Project report section.
  • Security issues—a list of detected vulnerabilities with filters for severity, status, tool, and other parameters. For more information, see the Security issues section.

You can process detected issues by changing their status, assigning an owner, adding a comment, or marking them as false positives. For more information, see the Process security issues section.

What's next?​