For general information & instructions on the use of Remote Providers within ThreadFix, please refer to the Remote Providers parent page. For information on REST API functionality for Remote Providers, please refer to the following: Remote Providers API.
Introduction
Veracode Software Composition Analysis detects open-source vulnerabilities in the software development process with higher accuracy. Veracode SCA reduces false positives by prioritizing vulnerabilities in the execution path of the application. Its proprietary database contains significantly more vulnerabilities than the NVD because it data mines pull requests, bug reports, and release notes.
Account Requirements
Application Access
If the Veracode account used to connect from ThreadFix has any team restrictions, it will only be able to see applications that the team(s) can access. Example:
In this scenario, the account will only be able to see applications to which the 'ThreadFix Team' team is allowed access.
Role
In order to import scans from Veracode:
If using an API Account (non-human user), it must at least have the 'Results API' role within the User Roles section of the account's Access Settings.
If using a human account, it must at least have the 'Reviewer' role within the User Roles section of the account's Access Settings.
Mitigation and Remediation Status Parsing
Mitigation Status
Accepted - if the action is "Potential False Positive," ThreadFix marks the vuln vulnerability as False Positive.
Proposed - ThreadFix marks the vuln vulnerability as Contested.
Remediation Status
Fixed or Mitigated (e.g., Mitigated By Design/OS Environment/Network Environment) - will not be imported into ThreadFix. If the finding had been previously imported, the vuln vulnerability will be closed.
Software Composition Analysis (SCA)
In ThreadFix 2.8 and higher, Software Composition Analysis findings are displayed alongside standard Veracode findings. The image below shows a Recent Applications view in Veracode.
The image below shows the Veracode SCA section where users can see component servlet-api.jar version 6.0.13 being used by Veracode application.
After importing into ThreadFix, the image shows Veracode SCA results in the ThreadFix application vulnerability tree view along with CVE reference link, component affected, version and description.
| Info |
|---|
When there is no scan data to import, a “No scans were found” message will display as the Last Import Attempt Status. |
SAST, DAST, and SCA Data Importing
The following describes how to import build IDs and obtain a report.
Get previously imported build IDs.
Get Build IDs of applications to import from Veracode by using their GetBuildList API call.
Compare these with previously imported build IDs and determine which to import. There is some import logic to consider.
If the user has force last scan and most recent scan only then this is only done for the most recent build ID.
If the user has most recent scan but not force last scan, ThreadFix will only fetch the scan if the Policy Updated Date provided by Veracode is after the most recently updated date provided by threadfix. Scan.updatedDate.
If the user needs all scans, ThreadFix will check the build IDs against those that have previously been imported and add all that have not been imported.
If a build ID has been previously imported, it will be imported if force last scan is enabled.
If a build ID has been previously imported, but force last scan is not enabled, dates will be compared to determine if it will be imported as described above.
After determining the build IDs, pull the detailed report for each one. This report contains the Dynamic, Static, and SCA flaw data by using Veracode’s DetailedReport API call. The results of this report follow this schema: https://analysiscenter.veracode.com/resource/detailedreport.xsd
Table of Contents
| Table of Contents |
|---|