Skip to main content
Version: 1.7

Quick start

Use this guide to complete the user journey in TRON.ASOC and perform the following actions:

  • log in to the system;
  • create your first project;
  • configure a security check;
  • start a scan;
  • view scan results.
info

This guide is intended for users who already have an account in TRON.ASOC. If you haven't installed the system yet, start with the Installation and first login section.

Before you start​

Make sure you meet the following requirements:

  • you have the system login link, your account username, and password (request them from your system administrator);
  • your role has permissions to create projects and security checks;
  • the administrator has configured an integration with at least one scan source (for example, a repository) and security tool in the Integrations section. For more information about configuring integrations, see the Integrations section.

Step 1. Log in​

To log in to the system, follow these steps:

  1. Go to the login page using the link you received from the administrator.
  2. Enter your account Username and Password.
  3. Select Login.
note

When you log in for the first time, the system prompts you to change your password. Your new password must meet the password requirements set by the administrator.

After you log in, the Dashboard home page opens with overall project statistics.

Step 2. Create a project​

A project is a top-level entity that combines the layers, security checks, and scan results for a product or service.

To create a project, follow these steps:

  1. Go to the Projects section.
  2. Select Add project.
  3. Enter the project code, name, description, and tags.
  4. Select Create.

For more information, see Create a project.

Step 3. Add a project layer​

A project layer (pipeline) is an entity that groups security checks, for example, by environment, service, or container.

To add a project layer, follow these steps:

  1. Open the project overview page and go to the Project layer tab.
  2. Select Add layer.
  3. Select From scratch or From template if you've already configured a template.
  4. Enter the name, description, and layer type, and optionally associate a quality gate.
  5. Select Create.
tip

If you've already configured a layer template for similar projects, creating a layer from a template saves time—most parameters are filled in automatically.

For more information, see Create a layer from scratch and Create a layer from a template.

Step 4. Add a security check​

A security check combines a scanning tool (for example, a SAST or SCA tool) and a scan source (for example, a repository). It starts the scan and returns the results.

To add a security check, follow these steps:

  1. In the project layer, select Add security check.
  2. Select a scan source and security tool from the integrations configured earlier.
  3. Complete the remaining form fields—the fields depend on the selected source and tool.
  4. Check the connection to the tool by selecting Test connection.
  5. Select Create.
warning

You must select the scan source and tool from the integrations configured by the administrator. If you need to add new integrations with sources or tools, contact your TRON.ASOC administrator.

For more information, see Create a security check.

Step 5. Start a scan​

You can start one security check or all checks in a layer:

  1. To start all security checks in a layer, select Start new scan on the project layer page. To start only one check, select the additional actions button in its row and select Start new scan.
  2. Wait until the check status changes from Scanning to Ready.

For more information, see Start a security check.

Step 6. View scan results​

After the scan finishes, results are available in several sections:

  • Dashboard—summary statistics and widgets for all projects. For more information, see the Dashboard section.
  • Project report—a summary or detailed report for a specific project. For more information, see the Project report section.
  • Security issues—a list of detected vulnerabilities with filters for severity, status, tool, and other parameters. For more information, see the Security issues section.

You can process detected issues by changing their status, assigning an owner, adding a comment, or marking them as false positives. For more information, see the Process security issues section.

What's next?​