HCL AppScan Boards Integration for Azure DevOps

The HCL AppScan Boards Integration plugin lets you import security issues from HCL AppScan on Cloud or HCL AppScan 360° directly into Azure Boards.

This plugin includes two main components:

1. A Service Connection for secure authentication.
2. A Pipeline Task that filters and imports security issues as work items.

Prerequisites

Before configuring the plugin, make sure your environment and Azure project meet the following requirements:

Azure pipeline requirements

To run this task, your build agent must meet specific version requirements. You can verify your agent version in Project Settings > Agent Pools > [Your Agent] > Capabilities.

• Agent version: 1.95.0 or later.
• Runtime: Node 20 (The agent must support Node 20 execution).
• Permissions: The pipeline requires the vso.work permission scope to create work items.

Azure Boards project requirements

To import issues successfully, your Azure DevOps project must use a supported process template and have the Bug work item configured correctly. If these requirements are not met, the pipeline task will fail during execution.

Important: The Basic process template is not supported because it does not define the standard Bug work item type required by this plugin.

Work item configuration

The Bug work item type must be enabled in your project and must contain the following fields:

• System.Title
• Microsoft.VSTS.TCM.ReproSteps (Repro Steps)
• Microsoft.VSTS.Common.Priority (Must accept integers 1, 2, 3, 4)
• Microsoft.VSTS.Common.Severity (Must accept strings "1 - Critical", "2 - High", "3 - Medium", "4 - Low")
• System.Tags

Note: Ensure the Bug work item does not have any other mandatory fields (unless they have default values defined), or the import may fail.

Important: The plugin only explicitly sets the fields listed above. Fields not set by the plugin (such as Assigned To) may be automatically populated if default values or rules are configured at the organization or project level in Azure DevOps. Review your Azure DevOps organization and project settings to understand how defaults might affect imported work items.

1. Configure the Service Connection

To enable the plugin to communicate with your AppScan server, you must first configure a service connection. This connection will be used by the pipeline task in the next step:

1. In your Azure DevOps project, go to Project Settings > Service Connections.
2. Select New service connection.
3. Search for and select HCL AppScan – Boards Integration Connection, and then select Next.

Configuration parameters

Verification steps

The verification process differs depending on your AppScan environment:

Option A: AppScan on Cloud

1. Select Verify and save.
2. Azure validates your credentials with the AppScan server. If correct, the connection is saved.

Option B: AppScan 360° (Private/On-Premises)

If you connect to an environment hosted on a private network, standard verification will fail because public Azure servers can't reach your internal network. Follow these steps instead:

1. Select the Allow Untrusted Connections checkbox.
   Security warning: This bypasses SSL certificate validation to allow communication with internal servers using self-signed certificates. Make sure this is compliant with your organization's security policies.
2. Don't select Verify and save.
3. Instead, scroll to the bottom of the pane, select the arrow next to Verify and save, and then select Save without verification.

2. Configure the Pipeline Task

The HCL AppScan Boards Integration task retrieves security issues and creates corresponding work items in Azure Boards. This task is typically added to the build or release pipeline after a scan completes.

To add the task:

1. Go to your pipeline definition.
2. Search for HCL AppScan Boards Integration and add it to your agent job.

Task inputs

Connection and scope

• AppScan credentials: Select the service connection created in the previous section.
• Scope: Select whether to import issues from an application or a specific scan.
• Application ID / Scan ID:
  • AppScan on Cloud users: Select the specific ID from the drop-down list.
  • AppScan 360° users: Manually enter the specific Application or Scan ID (automatic retrieval isn't available for private networks).

Filters

Configure the following filters to control which issues are imported:

• Scan type: Select the scan types to include (SAST, DAST, SCA, IAST).
• Issue status: Select the statuses to import (for example, Open, In Progress, Reopened).
• Issue severity: Select the severity levels to import (for example, Critical, High, Medium, Low, Informational).

YAML Pipeline Usage Example

To use the HCL AppScan Boards Integration task in your Azure Pipelines YAML configuration, add the following task to your pipeline:

Minimal Configuration (Using All Defaults)

Default values:

• Scan Types: All selected (DAST, SAST, SCA, IAST)
• Issue Status: Open, In Progress, Reopened (all enabled)
• Severity: Critical, High, Medium, Low (enabled); Informational (disabled)

If you want to use all defaults, you only need to specify the required parameters:

- task: HCLAppScanBoardsIntegration@1
  displayName: 'HCL AppScan - Import Issues to Azure Boards'
  inputs:
    AppSecTestService: 'AppScan-Cloud-Connection'   # Name of the AppScan service connection
    scope: 'Application'                            # Use 'Scan' to import issues from a specific scan
    appid: 'your-application-id'                    # Application ID; use the scanId when scope is 'Scan'

Only include parameters where you are changing the default value.

Task Output

After the task completes, it displays a Work Item Import Summary with the following metrics:

• Total filtered issues — All issues matching your selected filters
• Skipped issues — Issues already imported (have existing External ID in AppScan)
• Successfully imported — New work items created in Azure Boards
• Failed to import — Issues that failed during import (check logs for details)

3. View Imported Work Items in Azure Boards

After the task completes successfully, you can view the imported work items in your Azure Boards project. Here's an example of how a security issue appears as a work item in Azure Boards:

Troubleshooting and FAQ

Why does the "Test Connection" or "Verify" step fail for AppScan 360°?

Cause: AppScan 360° is often hosted on an on-premises, private network. The Azure DevOps "Verify" function originates from public Azure servers and cannot reach your internal URL.

Solution: This is expected behavior for private networks because the public Azure service can't reach your internal URL. When creating the Service Connection, you must select Save without verification from the save menu.

Why is the Application/Scan ID drop-down list empty?

Cause: If you're using AppScan 360° on a private network, the plugin can't query your server to populate the list dynamically during configuration.

Solution: You must manually copy the Application ID or Scan ID from your AppScan 360° dashboard and paste it into the task field.

What permissions does the task need?

The task creates work items in Azure Boards. Make sure your pipeline agent has the vso.work permission scope enabled.

Error: SYSTEM_ACCESSTOKEN is missing

Cause: The plugin requires the Azure DevOps system access token to create work items.

Solution: Classic Editor: Edit pipeline → Agent → Execution Plan → Enable Allow scripts to access the OAuth token → Save and re-run. YAML pipelines: Configure the system access token as described in the Microsoft Azure DevOps documentation.

Change Log

1.1.0 (September, 2026)

• Enhanced the work item import summary to display four detailed metrics: (Total filtered issues, Skipped issues, Successfully imported, Failed to import)
• Enhanced issue detail retrieval to include the description and resolution information from AppScan.
• Improved the documentation.

1.0.0 (February, 2025)

• Initial release of HCL AppScan Boards Integration for Azure DevOps.
• Added service connection for HCL AppScan on Cloud and AppScan 360°.
• Added pipeline task to import security issues as Azure Boards work items.
• Added filtering by scan type, issue status, and severity.