AppScan Cloud

Key Features

• Data Import:

  • Import applications, scan summaries, and application-vulnerable items into your Centraleyezer instance either on-demand or based on pre-configured automated schedules.

• Detailed Findings:

  • Complete request/response information for SAST vulnerabilities is provided as an attachment by Centraleyezer.

• Risk Scoring:

  • Configurable severity value for HCL AppScan Cloud (SAST findings) assessments, which can be adjusted based on organizational risk policies.

• Selective Data Import:

  • Supports configuration filters based on status, scan type, and severity for selective data import.

• Must-Have Connection:

  • An HTTPS connection is required, with or without a proxy.

Considerations

• The plugin supports mapping one HCL AppScan Cloud Server with one Centraleyezer instance. Configuring a different AppScan Cloud Server in the plugin will overwrite previously imported data.

Requirements

System Requirements

Centraleyezer Prerequisites:

• Latest version of the Centraleyezer Vulnerability Management Platform is recommended.

AppScan Cloud Prerequisites:

• HCL AppScan Cloud version 1.3.0 or newer, with API access.

Permissions and Roles

• System Admin (admin) or Application Security Manager (part of App-Sec Manager group) permissions required.

• HCL AppScan Cloud user access for SAST scan information.

• Permissions must be assigned to “admin” for import mappings.

Release Notes

Version 1.0.0

• Mapped vulnerabilities from HCL AppScan during SAST scans with the following fields:

  • Name: IssueType

  • CVE: Cve

  • CVSS: Cvss

  • CWE: Cwe

  • Asset: Constructed from scheme, domain, and path.

  • Severity: Severity

  • CVSS3 Score: cvss3_score

  • Protocol: protocol (defaults to ‘N/A’ if not specified)

  • Port: Port (defaults to 0 if not specified)

  • Targets: Includes location, element type, and element details.

  • Import Vulnerability ID: IssueTypeId

  • Permissions: Required to access import mappings.