Skip to content

Latest commit

 

History

History
139 lines (86 loc) · 6.6 KB

USAGE.md

File metadata and controls

139 lines (86 loc) · 6.6 KB
Raw

Fortify SSC Parser Plugin for Debricked results - Usage

Introduction

Fortify Application Security provides your team with solutions to empower DevSecOps practices, enable cloud transformation, and secure your software supply chain. As the sole Code Security solution with over two decades of expertise and acknowledged as a market leader by all major analysts, Fortify delivers the most adaptable, precise, and scalable AppSec platform available, supporting the breadth of tech you use and integrated into your preferred toolchain. We firmly believe that your great code demands great security, and with Fortify, go beyond 'check the box' security to achieve that.

This Fortify SSC parser plugin allows for importing CycloneDX SBOM files generated by Debricked into SSC. Two versions of this plugin are available:

  • fortify-ssc-parser-debricked-cyclonedx.jar
    • Parser plugin compatible with all recent SSC versions
    • Debricked issues are displayed on the SSC Audit page only
  • fortify-ssc-22.2+-parser-debricked-cyclonedx.jar
    • Parser plugin compatible with SSC 22.2 and above
    • Debricked issues are displayed on both SSC Audit page and SSC Open Source page

Plugin Installation

These sections describe how to install, upgrade and uninstall the parser plugin in SSC.

Install & Upgrade

Uninstall

  • In Fortify Software Security Center:
    • Navigate to Administration->Plugins->Parsers
    • Select the parser plugin that you want to uninstall
    • Click the DISABLE button
    • Click the REMOVE button

Obtain results

Automated import

The easiest approach for importing Debricked results into SSC is through fcli, using the fcli ssc artifact import-debricked command. This command will download the Debricked CycloneDX SBOM file using the Debricked REST API, and then upload the SBOM file to SSC for processing by this parser plugin.

When using fcli, there is no need to manually obtain the SBOM file, preparing a proper SSC third-party results zip-file, and uploading this zip-file to SSC. With this approach, the information in the Manual import and Upload results sections can be ignored.

Manual import

The Debricked website allows for generating a report in CycloneDX SBOM format using the following steps:

  • Navigate to the repository for which you want to generate the SBOM
  • Click on the 'Generate report' button on the top-right
  • Select 'SBOM'
  • Click the 'Generate' button
  • Extract the zip-file that is sent to your registered email address to obtain the raw CycloneDX SBOM file
    • Note: The instructions below for uploading the SBOM file to SSC are based on the raw CycloneDX SBOM .json file

These steps can also be automated through the Debricked REST API, allowing the generated SBOM either being sent to an email address, or downloaded directly through the REST API.

Upload results

Results can be uploaded through the SSC web interface, REST API, or SSC client utilities like FortifyClient or fcli. The SSC web interface, FortifyClient and most other Fortify clients require the raw results to be packaged into a zip-file; REST API and fcli allow for uploading raw results directly.

To upload results through the SSC web interface or most clients:

  • Create a scan.info file containing a single line as follows:
    engineType=DEBRICKED
  • Create a zip file containing the following:
    • The scan.info file generated in the previous step
    • The raw results file as obtained from the target system (see Obtain results section above)
  • Upload the zip file generated in the previous step to SSC
    • Using any SSC client, for example FortifyClient or Maven plugin
    • Or using the SSC web interface
    • Similar to how you would upload an FPR file

Both SSC REST API and fcli provide options for specifying the engine type directly, and as such it is not necessary to package the raw results into a zip-file with accompanying scan.info file. For example, fcli allows for uploading raw scan results using a command like the following:

fcli ssc artifact upload -f <raw-results-file> --appversion MyApp:MyVersion --engine-type DEBRICKED

This document was auto-generated from USAGE.template.md; do not edit by hand