For general information & instructions on the use of Remote Providers within ThreadFix, please refer to this page's parent page: Remote Providers.

For information on REST API functionality for Remote Providers, please refer to the following: Remote Providers API

Introduction

HCL AppScan Enterprise mitigates application security risk, strengthen application security program management initiatives and achieve regulatory compliance. ThreadFix uses AppScan Enterprise's (ASE) Application Security Management REST API to authenticate and pull both application and scan information. 

User Role

Your ASE service user will need to have Job Administrator role in order for ThreadFix to use the endpoints below to obtain the necessary data.

Fetching Applications

ThreadFix uses this endpoint to pull applications from the ASE instance:

/ase/api/applications

• ThreadFix does paginate this request.

Fetching Scans

ASE's Application Security Management REST API does not currently provide an endpoint to get issues from an application by scan. Instead, ThreadFix uses these endpoints:

/ase/api/issues

• Returns issues from ASE based on query parameters.
• ThreadFix uses this to pull the severity, status, datecreated, location and issuetype values of each finding from all new, open and reopened issues for the specified application.
• ThreadFix does paginate this request.

/ase/api/issueattributedefinitions

• The issues endpoint returns attribute ids instead attribute names. ThreadFix uses this endpoint to pull the attribute names to parse the issues.

Scan Dates

As of ThreadFix version 2.7.9.1 (and requiring ASE v9.0.3.12 and higher, otherwise reverts to former functionality)... 

• ThreadFix uses this endpoint and finds the latest Last Run Date of the returned jobs:

/jobs/search/

• If a job does not have a Last Run Date, that means it has not been run before, but just configured to run, so these are ignored.
• In the absence of any jobs with a Last Run Date, or any jobs configured, ThreadFix attempts to get the latest Date Created via the /issues endpoint.

Scan Updated Date:

• ThreadFix uses the /issues endpoint to search for the latest Last Updated Date for all the findings, regardless of severity. ThreadFix configures the parameters to only return one value, which is used as the Scan Updated Date.

Former functionality, prior to ThreadFix 2.7.9.1 (and/or if integrating with ASE version older than 9.0.3.12):

• ThreadFix organizes the results from the issues endpoint by rounding down their datecreated value to midnight and creating scans for each unique date.
  • Caveat: If one or more issues have a lastupdated value, the newest of these values will be used when setting the scan's Scan Date.
• Since these scans are dynamically created by ThreadFix, there is currently no distinction between the Scan Date and the Updated Date.

Parsing Vulnerabilities

The JSON returned by ASE's issues endpoint maps directly to these ThreadFix Finding Mappings:

• Native Id - id
• Vulnerability code - issuetype
• Severity code - severity
• Path - location

Configuring Certificates

AppScan Enterprise requires its certificate to be stored in your ThreadFix web server's Java keystore. You may run into a "...SunCertPathBuilderException: unable to find valid certification path to requested target..." error when:

• Migrating to a new ThreadFix web server or AppScan Enterprise Server
• Changing or updating the ThreadFix  web server's Java installation
• Clearing your ThreadFix web server's Java keystore

Please refer to our Importing External Site's Certificate documentation to resolve this issue.

Generating Scans

Please refer to our File documentation for steps on how to generate a scan using AppScan Enterprise.