For general information & instructions on the use of Remote Providers within ThreadFix, please refer to this page's parent page: Remote Providers. For information on REST API functionality for Remote Providers, please refer to the following: Remote Providers API.
Introduction
Contrast IAST Scanner Integration uses sensors to passively monitor the behavior of applications and discover vulnerabilities quickly and accurately.
List of API requests that ThreadFix uses for Contrast Remote Provider integration:
Organizations: /Contrast/api/ng/profile/organizations/default
Applications: /Contrast/api/ng/<orgId>/applications
Modules: /Contrast/api/ng/<orgId>/modules/<appId>
Issues: /Contrast/api/<orgId>/traces/<appId>
Events Summary: /Contrast/api/ng/<orgId>/traces/<traceId>/events/summary
Recommendation: /Contrast/api/ng/<orgId>/traces/<traceId>/recommendations
Scan Date and Updated Date are determined and set based on when a scan is imported into ThreadFix.
User Account Requirements
UI and “API Only” Contrast user account types are both able to integrate with ThreadFix. Use the Organization API Key and Personal Service Key found on user profile. To find the API Only user Service Key, from an admin account hover over the API Only label on list of users located at Organizational Settings > Users as shown in screenshot.
Organization Role
Both Contrast UI and API Only type users require Organizational Role “View” at a minimum.
Application Access Group
Both Contrast UI and API Only type users require Application Access Group “View” at a minimum.
Please note both user types, UI and API Only, require “UI Access” option toggled on. Although this does not allow login access for the API Only user, it is still required for ThreadFix integration.
=================================================================
We will update this page at a future time with more details on the Remote Provider integration with this specific scanning tool.
If you have any questions, please reach out to support@threadfix.it.