📙 You will learn

Prerequisites

Audience: IT Professional or End User
Difficulty: Basic, Intermediate or Advanced
Time needed: Approximately __ minutes
Tools required: If any

This section outlines the ThreadFix Defect Tracker (tool) support.

Introduction

ThreadFix supports Defect Trackers, this involves two primary functions. The first is to bundle and export ThreadFix vulnerabilities into the tracker's defect format. The second is to get the current status of the defect from the tracker and update the ThreadFix vulnerabilities.

Supported Defect Trackers

ThreadFix currently supports these Defect Trackers:

• Bugzilla

• HP Quality Center

  • Suggested if we support it : Micro Focus Quality Center (formerly HP Quality Center, this has been removed from HP’s website)

• JIRA [On Premise, On Demand]

• Microsoft Team Foundation Server (TFS), Visual Studio Team Service (VSTS), and Azure DevOps

• Version One

• IBM Rational ClearQuest 

• Rally (CA Agile Central)

Bugzilla

Bugzilla is a popular open-source defect tracking system created by the Mozilla Foundation, the developers of Firefox. The Bugzilla website has more information about its features and installation.

HP Quality Center (acquired by Micro Focus)

This no longer seems to exist, not on HP’s website and support for it seems to be gone too. Seems to have been replaced with https://www.microfocus.com/en-us/products/alm-quality-center/overview any suggestions?

Hewlett-Packard's Quality Center is quality management software featuring defect and requirements tracking. It is available as a free, open-source Community Edition or as a paid Enterprise version. The Enterprise version has an expanded feature set and technical support. Installation of HPQC Enterprise can be on premise, or is available in a SaaS implementation. More information regarding HP Quality Center is available on the HP website.

JIRA

Atlassian's JIRA is a project management and issue tracking application, geared toward agile development. Users can install JIRA on their own server, or use a hosted, SaaS solution. More information is available on the Atlassian website. OAuth is supported in ThreadFix for JIRA.

To be able to submit defects, the JIRA user account must have these permissions: Browse Projects, Create Issues, Assign Issues and, if the project does not allow non-assigned issues, at least one user must have the Assignable User permission.

ThreadFix leverages JIRA’s Status and Status Category* fields to determine if a defect is Open (red) or Closed (green). Note: If the Status Category is available, ThreadFix prioritizes it over Status.

JIRA has three status categories: To Do, In Progress, and Done. If a defect has a Status Category of “Done”, it is considered Closed in ThreadFix. The status of “Resolved” falls under the “Done” category.

Microsoft Visual Studio Team Foundation Server / VSTS

Microsoft's Visual Studio Team Foundation Server is a version control and project management platform aimed at developing Windows applications.  This application shares the same API as Visual Studio Team Services. More details about Team Foundation Server are on Microsoft's website. For info on how to configure security on the VSTS side, see the corresponding section at the bottom of this article.

VersionOne

VersionOne is an Application Lifecycle Management platform, designed with agile and lean development methodologies as its focus. Read more about its features and capabilities on the VersionOne website.

IBM Rational ClearQuest

IBM Rational ClearQuest is a database workflow application development and production system. You can read more about its features on the IBM Rational ClearQuest website.

Rally (CA Agile Central)

Rally (now CA Agile Central) is an enterprise-class platform that's purpose-built for scaling agile development practices. It provides a hub for teams to collaboratively plan, prioritize and track work on a synchronized cadence. You can read more about its features and capabilities on the CA Technologies website.

Creating a Defect Tracker

Example Configuration Using JIRA

Creating a defect tracker in ThreadFix follows the same process for every supported tracker. The following example walks through the process using JIRA.

Set up Defect Tracker

Users must complete two actions before submitting a defect from ThreadFix. First create the defect tracker within ThreadFix, then attach the defect tracker to an application in ThreadFix.

Create a Defect Tracker

To set up JIRA up as a defect tracker in ThreadFix click:

1. From the Navigation sidebar, expand the Application menu, click the Integrations sub-menu and select the Defect Trackers page.
   

   

2. To create a new Defect Tracker, click the Create New Tracker button. A New Defect Tracker modal will appear. Complete the form using the credentials for a JIRA account; ensure that the Type dropdown list is set to JIRA.
   For JIRA Cloud customers who are using username and password:

   • For the Default Username, enter the JIRA profile's email address. For the Default Password, enter the profile's API token (create one, if it doesn't exist).

   • The above is supported as of version ThreadFix version 2.7.3 (equivalent for 3x support version?); earlier versions don't support email usernames nor API authentication.

   For on-premise JIRA deployments that don't support API tokens, use username/password basic authentication; using the email address for the username is supported as of version 2.7.3 (equivalent for 3x support version?).
   

   

3. As of ThreadFix version 2.8.1, to configure a Jira Defect Tracker using username/password. Select Basic Auth for Auth Type. Confirm this does not exist in 3x? (at least not in 3.0.6+?)
   

   

4. Click the Get Product Names button. A Product Names drop-down will appear, populated with the products from the user JIRA server. Select the product associated with the application and click the Create Defect Tracker button.
   

   

Attach Defect Tracker

1. Navigate to the details page of the application that needs a tracker attached to it. Once on the application’s detail page, click the Action drop-down button, highlight Manage Defect Trackers and select Edit Defect Trackers.
   

   

2. The Manage Defect Trackers for Application <application name> page displays a list of attached defect trackers, if any.
   

   

3. To attach a defect tracker to the application, click the Add Defect Tracker button. A modal dialogue will appear.
   

   

4. For the Defect Tracker, from the drop-down list select [the created] JIRA Defect Tracker. Then either select the Use Default Credentials checkbox or fill in the Username and Password fields with the necessary credentials. The defaults are the credentials supplied when [the Defect Tracker was created] you created the TF JIRA defect tracker initially.
   

   

5. If there is a default product defined in JIRA, users may select the Use Default Product checkbox. If not, or to select a different product, click the Get Product Names button. After JIRA verifies the credentials, a Product Name drop-down appears. Select the JIRA product that is associated with the application and click the Add Defect Tracker button.
   

   

6. The added defect tracker will now appear in the Defect Trackers page.
   

   

Submit Defects

1. To submit a defect to the defect tracker, expand a section in an application's vulnerability tree. Either select the instance(s) of the vulnerability(ies) to submit to the tracker, or select the Check All checkbox to select all instances.
   

   

2. Click on the lower Action button and highlight Create Defect then select <defect tracker name>.
   

   

3. A Submit Defect modal will appear; fill out the fields and click the Submit Defect button. A success message will appear at the top of the screen.
   

   

4. Opening the vulnerability in the tree now shows these issues opened and assigned in the JIRA defect tracker, as seen below.
   

   

5. Clicking on the defect badge will open another window showing the defect in JIRA. Cannot see this when I click on the created defect in the above example
   

Add to Existing Defect

Users can add one or more vulnerabilities to an existing defect.

1. Either select the instance(s) of the vulnerability(ies) or select the Check All checkbox to select all instances.
   

   

2. Click on the lower Action button, highlight Add to Existing Defect and select <defect tracker name>.
   

   

3. In Add to Existing Defect modal, enter the defect ID and click the Submit Defect button.
   

   

4. Just like when creating a new defect, ThreadFix will add a badge to the vulnerability(ies) with the defect ID and its status.
   

   

Update Defect Status

If the issue is closed in JIRA, users can request an update for the defects in ThreadFix on the application’s details page.

1. Click on the upper Action button, highlight Manage Defect Trackers and select Update Defect Status.
   

   

2. ThreadFix will get the current status of all defects submitted for the application and update the label accordingly if one or more defects are closed. Refresh the page to see the updated status. Need help with an updated screenshot to replace the one below, showing an updated defect status for the example submitted above.
   

Creating a Defect Status Update Schedule

Continue

Once one or more defect trackers are configured, users can create a schedule or schedules to automatically check their status for changes. This removes the need to manually update the defect status to see if an issue has been resolved by a development team or not.

1. First, return to the Defect Trackers. From the Navigation sidebar, expand the Application menu, click the Integrations sub-menu and select the Defect Trackers page.
   

   

2. Select the Scheduled Updates tab and click the Schedule New Update button. This brings up a Defect Tracker Update modal which contains scheduling options.
   

   

3. Select the time and frequency for when to run the status update check. Users can alternatively define a Cron expression.  Click the Add Scheduled Update to save it to the list of defect status update schedules.
   

   

Optionally, an “Update status for deleted defects” checkbox is provided. If selected this option will allow ThreadFix to update each defect, including marking deleted defects as “Issue not found”.

Users may create as many as desired, however each one will run at the requested time. Some defect trackers require an API call per defect to determine status, so the user could inadvertently overwhelm their defect server if these are scheduled too frequently.

Defect Profiles

To help make the process of submitting a defect more efficient, users can create and use defect profiles which save the effort of filling out certain fields in the submission form. The following uses Jira with the above as an example for a user who wants to create a profile that preselects the type of defect and fills out several fields. (Is this prior statement accurate?).

1. From the Navigation sidebar, expand the Application menu, click the Integrations sub-menu and select the Defect Trackers page.
   

2. Click the Show Default Profiles button, this will display a field for existing profiles and add a Create Profile button.
   

   

3. Click the Create Profile button.
   

   

4. Give the profile a name, select a product, then click Add new Default Profile.
   

   

   Note the Name field has a 2 character limit.

5. Recommended options to select for this portion below in order to be able to get an updated screenshot? Fill out the desired fields in the Set Defect Defaults form. Note tags can be used to help automate some of the content, like the severity, scanner vulnerability name, etc. (hover over the tags at the top for a description). When finished, click the Update Defaults button.
   

A confirmation banner will display showing the defaults were updated for the specified defect profile and see it listed within the Profile list. Create more as necessary. The options to enter above will affect a new screenshot for below.

To use a profile when submitting a defect, select it from the top pull-down menu, and the default values will appear in the form; edit as needed and submit the defect when done. Note the values corresponding with tags in the profile will appear in the form.

VSTS / TFS / Azure DevOps - Security Configuration

In order to set up an integration between ThreadFix and VSTS, a Personal Access Token is required.

1. In VSTS, click on the profile icon toward the top right of the screen and select Personal access tokens from the menu.
   

   

2. From there create a Personal Access Token:
   

   

3. When creating the integration on the ThreadFix side, select Microsoft TFS in the Type menu, enter the organization's http://visualstudio.com (or dev.azure.com) URL and credentials, then click the Get Product Names button to select the desired project. Note the username can be anything as long as the field is not left blank. Is there a url I can use for a fresh screenshot of the image below?

OAuth Support for JIRA - Security Configuration

OAuth is supported for Jira as of version 2.8.1. Please note OAuth 2.0 is not yet supported (any change on this?).

1. First configure Application links in JIRA to support OAuth. Then, within ThreadFix, navigate to Global → Administration → System Settings → Other Settings (tab) → OAuth Jira (heading). Provide the following details:

   1. Jira URL: URL of Jira where OAuth is configured.

   2. Consumer Key: The key assigned to JIRA by the service provider. 

   3. Private Key: Signed Private Key.
      Is this a removed feature? I don’t see this in 3x

      

2. After providing the details, click on Populate Authorization Token URL button. This will generate a temporary Authorization Token URL. Click on the here link in For retrieving request token go to here and authorize it. This will expire in 10 minutes. 
   

   

3. The link navigates to a permission page in JIRA. Allow the permission.

   

4. After allowing the permission, a verification code will be generated. 

Copy and paste the verification code into the Secret Key text field in ThreadFix and click on the Populate Access token button. A new Access token is generated and will be active for 5 years. 

Configuring Defect Tracker using Access Token

Jira can be set up as a defect tracker in ThreadFix.

1. From the Navigation sidebar, expand the Application menu, click the Integrations sub-menu and select the Defect Trackers page.
   

2. To create a new Defect Tracker, click the Create New Tracker button and select JIRA as Type.
   

3. Select OAuth Token for Auth Type. Url and Access Token will be automatically filled. This doesn’t appear for me in order to proceed.
   

   

4. Click the Get Product Names button. A Product Names dropdown will appear, populated with the products from the user’s JIRA server. Select the product associated with the application and click the Create Defect Tracker button.
   

Attach Defect Tracker

1. Navigate to the details page of the application that needs a tracker attached to it. Once on the application detail page, click the upper Action button and highlight Manage Defect Trackers and select Edit Defect Trackers.
   

   

2. This will redirect to the Manage Defect Trackers for Application <application name> page, where attached defect trackers are listed, if any.
   

   

3. To attach a defect tracker to the application, click the Add Defect Tracker button. A modal dialogue will appear. Choose JIRA as the Defect Tracker, then the Access Token will be automatically added to text box.
   The modal below is not what I see
   

   

   This is what I see, is this just how it looks in 3x or does 2x currently match this and the one above is just very outdated?
   

   

4. If a default product is defined in JIRA, select the Use Default Product checkbox. If not, or to select a different product, click the Get Product Names button. After JIRA verifies credentials, a Product Name dropdown appears.
   This is what I can see is it still correct?

   

5. Select the JIRA product that is associated with your application and click the Add Defect Tracker button.
   Again I don't see modal like this below

This is how it appears to me

The added defect tracker will now appear in the Manage Defect Trackers page.