Image Added

📙 You will learn

How to generate a Fortify Audit Workbench report and upload it to ThreadFix.

Prerequisites

Audience: IT Professional
Difficulty: Basic
Time needed: Approximately 10 minutes
Tools required: N/A

Generate Results

1. After launching Audit Workbench,

1. select Scan Java Project...:
   

   Image Added

Image Removed

1.  

2. Select the directory containing the Java Project to be scanned and

1. click OK:
   

Image Removed

1. Image Added

    

2. Select the version of Java the project uses and

1. click OK:
   

   Image Added

Image Removed

1. Select the

1. appropriate options from for the

1. project (the defaults work for a majority of projects) and

1. select Scan:
   

Image Removed

1. Image Added

    

2. After the scan has finished, from the File menu select

1. Save Project As... and save the results to the desired directory:
   

Image Removed

Image Added

Notetitle

Filter Set

To see all vulnerabilities within Audit Workbench before uploading them to ThreadFix, go to Tools -> Project Configuration > Filter sets

 and make “Security auditor view” the default filter set before saving. 

Upload Results

1. After generating

1. a report, log in to ThreadFix and navigate to the 

1. Portfolio page, found on the Navigation sidebar under the Application sub-menu.
   

   Image Added

    

2. Expand the Team

1. the report will be uploaded to:
   

   Image Added

Image Removed

1.  

2. After picking one of the Team's

1. applications, select Upload Scan and drag the report into the

1. pane:
   

   Image Added

Image Removed

1.  

2. Once ThreadFix

1. finishes processing the report, the results can be viewed on the

1. individual application's page:
   

Image Removed

1. Image Added

Finding Status Processing

The following list indicates how finding statuses from Fortify are marked within ThreadFix when ingesting a scan:

• Not an issue

  or

   or Suppressed - False Positive

• Exploitable

  or

   or Need more information - Open

• Hidden - not ingested into ThreadFix