HCL AppScan Standard integration

Scan types imported

• Dynamic web application testing (DAST)
• Full test HTTP traffic evidence

Upload the AppScan Standard XML report. The template walks each issue and resolves its issue-type, advisory and URL references from the report’s lookup groups.

What Centraleyezer expects in the file

• The standard AppScan Standard XML report export (with issue-group, issue-type-group, advisory-group and url-group sections intact).
• Per issue: issue type name, CWE, CVE, technical description from the advisory, fix recommendation, affected URL and severity (AppScan severity 1–3).
• Test HTTP traffic — request and response chunks — is preserved as finding evidence.
• The web asset is matched by the scan’s starting URL.

How imported findings are risk-scored

Every HCL AppScan Standard finding is normalised into Centraleyezer’s risk model on import: the scanner’s native severity scale maps to a configurable DREAD vector (Damage, Reproducibility, Exploitability, Affected users, Discoverability), which combines with asset criticality, network exposure, exploitability intelligence and the platform’s other risk factors to produce one comparable risk score across every scanner you run. CVE, CVSS and CWE metadata are preserved on the finding for reference and reporting, and duplicate findings from repeated imports are automatically correlated instead of creating noise.