Performs static, dynamic, mobile and open source security tests for your applications
HCL AppScan Azure DevOps extension enables you to execute SAST (Static Application Security Testing) and MAST (Mobile Application Security Testing) scans using HCL AppScan On Cloud and DAST (Dynamic Application Security Testing) scans using both HCL AppScan On Cloud (ASoC) and HCL AppScan Enterprise (ASE)
This extension runs on Windows, Linux and MacOS agents and works with Azure DevOps Service and Azure DevOps Server 2018 Update 2 and above. Please note that AppScan Enterprise DAST scans can only be executed on Self-Hosted agents.
The plugin supports scanning through HCL AppScan on Cloud and HCL AppScan Enterprise.
HCL AppScan on Cloud prerequisites
An account at the HCL AppScan on Cloud service. You'll need to create an application on the service to associate your scans with.
HCL AppScan Enterprise prerequisites
HCL AppScan Azure DevOps Plug-in supports integration with HCL AppScan Enterprise for creation and execution of DAST Scans. To use this integration, you must have access to a running instance of AppScan Enterprise Server version 22.214.171.124 or later. Please note that Content Scan jobs are not supported through this integration.
Highlights of the extension:
Dedicated HCL AppScan service endpoints for authentication to ASoC and AppScan Enterprise servers.
Three build tasks:
HCL AppScan On Cloud to configure all the required settings before executing the build on HCL AppScan On Cloud.
HCL AppScan Enterprise to configure all the required settings before executing the build on HCL AppScan Enterprise
HCL AppScan - This is a deprecated task to support jobs configured prior to 2.0.0 release. This only supports integration with HCL AppScan On Cloud. Any enhancements for executing scans on HCL AppScan On Cloud will not be available in this deprecated task.
Features of HCL AppScan On Cloud Task
Configuration parameters and fail build conditions for Dynamic, Static and Mobile analysis.
A Build Summary info displaying the non-compliant issue count based on severity, once the scan completes successfully.
An option to download scan report in HTML format, post successful scan completion. This report includes only the non-compliant issues.
Please note that scan report and summary are available only if Suspend job until security analysis completes option is selected. Otherwise, download the report from HCL AppScan on Cloud portal post successful scan completion.
This Getting Started guide, includes comprehensive information on installing, configuring and using the HCL AppScan extension for Azure DevOps.
Features of HCL AppScan Enterprise Task
Configuration parameters and fail build conditions for DAST scans
A Build Summary info displaying the issue count based on severity, once the scan completes successfully.
An option to download scan report in JSON format from pipeline logs, post successful scan completion.
Please note that .login file is supported from AppScan Enterprise 10.0.4 release onwards.
If you add same AppScan task more than once in the same pipeline, the report displayed in Summary tab, post successful scan execution, will only be for the last executed task. The reports for all the tasks will be available in build pipeline logs.
If you have created an ASoC YAML pipeline with Azure DevOps Plugin version 2.0.0, you will encounter the following error while trying to execute the pipeline post upgrade to Azure DevOps Plugin version 2.0.1:
"The task name HCLAppScan is ambiguous. Specify one of the following identifiers to resolve the ambiguity:
To resolve this issue, edit the name of the task to HCLAppScanOnCloud@2.
Support Personal scans in HCL AppScan on Cloud.
Fix a customer reported bug to ensure, pipelines created using YAML scripts for execution of scans on HCL AppScan On Cloud work as expected when the extension is upgraded from 1.2.8 to version 2.0.1 or above.
Supports integration with HCL AppScan Enterprise for creation and execution of DAST scans.
Support open source only scans in Static Analysis.
Fix a customer reported bug to ensure static scans do not fail for successful IRX file generation, even if output is written to stderr.
Extension name change from Application Security Testing by HCL Technologies to HCL AppScan.
Marketplace overview update, highlighting major features of the plugin.
Support for specifying speed and depth levels for static scans. The levels include "simple", "balanced", "deep" and "thorough" with "deep" set as default.
Support for V10 Test Optimization levels for Dynamic Scans. These are "No Optimization", "Fast", "Faster", "Fastest".
Added License terms to marketplace
Updated the extension icon to AppScan
Validation of Starting URL for dynamic scans
HCL Washed Changes
Added "Suspend Job" option, to allow users to continue with Build pipeline while security scans run in background.
Support for Test Optimization in DAST Scans.
Updated Overview section with a link to Getting Started guide
Support for Dynamic Application Security testing (DAST) and Mobile Application Security Testing (MAST) in Azure Pipelines
Display of Issue Info in Build Summary page.
Support for Static Application Security Testing (SAST) in Azure pipelines.