For general information & instructions on the use of Remote Providers within ThreadFix, please refer to the Remote Providers parent page. For information on REST API functionality for Remote Providers, please refer to the following: Remote Providers API

Introduction

Veracode Software Composition Analysis detects open source vulnerabilities in the software development process with higher accuracy. Veracode SCA reduces false positives by prioritizing vulnerabilities in the execution path of the application. Its proprietary database contains significantly more vulnerabilities than the NVD because it data mines pull requests, bug reports, and release notes.

Account Requirements

Application Access

If the Veracode account used to connect from ThreadFix has any team restrictions, it will only be able to see applications that the team(s) can access. Example:

In this scenario, the account will only be able to see applications to which the 'ThreadFix Team' team is allowed access.

Role

In order to import scans from Veracode:

• If using an API Account (non-human user), it must at least have the 'Results API' role within the User Roles section of the account's Access Settings.

• If using a human account, it must at least have the 'Reviewer' role within the User Roles section of the account's Access Settings.

Mitigation and Remediation Status Parsing

Mitigation Status

• Accepted - if the action is "Potential False Positive," ThreadFix marks the vuln as False Positive.

• Proposed - ThreadFix marks the vuln as Contested.

Remediation Status

• Fixed or Mitigated (e.g., Mitigated By Design/OS Environment/Network Environment) - will not be imported into ThreadFix. If the finding had been previously imported, the vuln will be closed.

Software Composition Analysis (SCA) 

In ThreadFix 2.8 and higher, Software Composition Analysis findings are displayed alongside standard Veracode findings. The image below shows a Recent Applications view in Veracode.

The image below shows the Veracode SCA section where users can see component servlet-api.jar version 6.0.13 being used by Veracode application.

After importing into ThreadFix, the image shows Veracode SCA results in the ThreadFix application vulnerability tree view along with CVE reference link, component affected, version and description.