Introduction

Remote Providers are an interface that ThreadFix uses to import scans from SaaS platforms. Not all Remote Providers operate in the same manner, please refer to each Remote Provider guide below for further details as well as the ThreadFix Integrations page.

Note ThreadFix Bidirectional Sync has been deprecated.

In ThreadFix version 2.8, and higher, the interface is accessible from the sidebar on the left under Integrations → Remote Providers. 

Open

In ThreadFix prior to version 2.8 the interface is accessible through the Configuration (cog) menu under Integrations → Remote Providers.

The following documentation provides the steps for setting up and importing data from the supported remote providers. Please note images show ThreadFix version 2.8 which looks slightly different from previous versions.

Create New Provider

To add your Remote Provider instance to ThreadFix, select Create New Provider, and from the Create New Provider modal:

• Select the desired scanner in the Type field

• Enter the credentials, specify if you'll want to import All scans or only the Most recent (if applicable)

• Indicate if you want to Force Last Scan (if applicable), which allows you to force an import even when there hasn't been a new scan run...e.g., in case you've updated one or more findings on the scanner side since the last scan:

ThreadFix will import all of the integration's existing applications (even if there are no scans assigned to them):

Edit Remote Provider

To edit a Remote Provider's configuration, click on its blue edit button on the right edge of the integration listing, which will pop up an Edit Provider dialog.

Note: In order to save changes to the integration's configuration, you will need to re-enter the account's password. The Save button will otherwise remain disabled.

Import Scans

In order to import scans into ThreadFix, the Remote Provider applications need to be mapped to a Team/Application combo. A user can either:

• Select Create ThreadFix Applications

• Manually create applications in ThreadFix and select Edit Mapping

Create ThreadFix Applications

Selecting Create ThreadFix Applications will ask for ThreadFix Teams to assign each AppScan Application to:

When clicking the Create Applications button, ThreadFix will create a new ThreadFix application with the same name as its Remote Provider application counterpart and assign it to the selected Team.

Edit Mapping

Selecting Edit Mapping will ask for the Team/Application Combo to which you want the Remote Provider application mapped:

Sync Remote Provider Applications

As applications are added/removed/renamed on the Remote Provider side, you can click the Sync Remote Provider Applications button to add or remove applications from the list of Remote Provider applications.

ThreadFix will provide a banner indicating what, if any, applications were added/removed.

Import to ThreadFix

You can either import scan data for all of a remote provider's mapped applications at once (Import All Scans button) or for a particular application (individual Import buttons):

Once the scans have finished importing, you'll be directed to the corresponding Application Details page. The Scans tab will display the scans that were imported:

The Remote Provider Application tab will show the import status:

Note that another method to import a scan is to click the Import (arrow) button within the Remove Provider Application tab.

Scheduled Imports

Via the Scheduled Imports tab, you can schedule Remote Provider scans.

To do so, click the Schedule New Import button, indicate when you want the import to occur and specify the Remote Provider and application, then click the Add Scheduled Import button. Introduced in 2.8.3, when scheduling a Remote Provider Import, a time zone drop down will allow users to set a desired time zone region for the scheduled job. This is applicable for both Select and Cron Expression scheduling methods.

The scheduled import will then be reflected in the list.

Scan Orchestration

ThreadFix supports scan orchestration via the UI for Netsparker Enterprise and Acunetix 360. In order to use the Scan Orchestration feature the ThreadFix user must have “Manage Remote Provider Scans” permission. After having configured the Remote Provider and mapped it to a ThreadFix application, you can click the Request button to initiate a scan, after which you can click the Import button to import the result.

Another method to initiate a scan orchestration is to click the Scan Orchestration (rocket) button within the Remove Provider Application tab as seen below for Netsparker Enterprise and Acunetix 360 respectively. Note this is the only currently available method for Acunetix 360.

ThreadFix also supports scan orchestration for Checkmarx, though currently only via REST API. Reference: Queue Remote Provider Scan - API

Scanner-specific Notes

AppScan Enterprise

In order to connect to AppScan Enterprise, you may need to import the AppScan server's certificate into the ThreadFix server's Java keystore. Otherwise you may receive the following error:

...SunCertPathBuilderException: unable to find valid certification path to requested target

Instructions for importing the certificate can be found in the Importing External Site's Certificate guide.

Checkmarx

Checkmarx requires that you have Server Manager role to pull scan data from your instance via API.

Importing Server Certificates

If your connection to a Remote Provider server requires that you import the server's certificate (otherwise resulting in "...SunCertPathBuilderException: unable to find valid certification path to requested target..." error), please refer to the following page for instructions on importing the cert: Importing External Site's Certificate