Welcome
Software Composition Analysis
Use Software Composition Analysis (SCA) to scan for security vulnerabilities in open source and third-party packages used by your code.
Scanning libraries and third-party code for security vulnerabilities
To scan open source libraries and third-party code for security vulnerabilities, follow the steps in these topics.
Configure an open source scan in AppScan on Cloud
Scan a repository
Software Composition Analysis (SCA) scans can be configured and scheduled to pull source code directly from a GitHub, GitLab, or Bitbucket repository. When triaging findings, users can view the relevant source code directly in the repository. Findings can be filtered by filename or path. AppScan on Cloud supports scanning one repository per scan
Onboarding multiple repositories for scanning
Configure connections to repositories from the Applications page for static analysis and Software Composition Analysis scanning.

Getting started
Welcome to the documentation for HCL AppScan on Cloud, where you can find information about how to install, maintain, and use this service.
Navigation
This section describes navigating AppScan on Cloud, including items on the side main menu and top navigation bars, with links to more detailed information.
Management
Define users, roles, groups, applications, policies, and configure DevOps integrations.
Dynamic analysis
AppScan on Cloud performs security scans for web-applications for production, staging and development environments. For development environments it is aided by Private Site Scanning technology to scan applications not accessible to the open Internet.
Interactive monitoring
Using an agent installed on your application, ASoC identifies security vulnerabilities in your application during runtime by monitoring all interactions, both legitimate and malicious. The process is "passive," in the sense that IAST does not send its own tests, and can therefore run indefinitely.
Software Composition Analysis
Use Software Composition Analysis (SCA) to scan for security vulnerabilities in open source and third-party packages used by your code.
- About Software Composition Analysis
  Software Composition Analysis (SCA) identifies and examines open-source packages within your codebase to detect potential security vulnerabilities. SCA can analyze both individual source code files and package manager artifacts, such as configuration files, and lockfiles, to determine the open-source packages your project depends on.
- System requirements for SCA
  The types of files that can be scanned by ASoC when you perform open source testing.
- Scanning libraries and third-party code for security vulnerabilities
  To scan open source libraries and third-party code for security vulnerabilities, follow the steps in these topics.
  - Configure an open source scan in AppScan on Cloud
    - Scan a repository
      Software Composition Analysis (SCA) scans can be configured and scheduled to pull source code directly from a GitHub, GitLab, or Bitbucket repository. When triaging findings, users can view the relevant source code directly in the repository. Findings can be filtered by filename or path. AppScan on Cloud supports scanning one repository per scan
      - Scanning private GitHub repositories
        While AppScan on Cloud allows you to perform comprehensive security scans on your public GitHub repositories using our advanced cloud service without additional setup, scanning private repositories requires the installation of the HCL AppScan on Cloud GitHub application.
      - Scan a repository using an AppScan Presence
        You can run static analysis directly on a GitHub Enterprise repository, a GitLab Self-Managed repository, a GitLab SaaS repository or a Bitbucket repository using an AppScan Presence.
      - Setting up an AppScan Presence to scan a GitHub repository
        You can use an AppScan Presence to run static analysis on GitHub Enterprise repositories.
      - Setting up an AppScan Presence to scan a GitLab repository
        Use an AppScan Presence to run analysis on GitLab Cloud and GitLab Self-Managed repositories.
      - Onboarding multiple repositories for scanning
        Configure connections to repositories from the Applications page for static analysis and Software Composition Analysis scanning.
    - Scan status
    - Proactive monitoring
      Software Composition Analysis (SCA) scans can be monitored continuously for the presence newly published CVEs. Proactive scanning can be applied to new scans and to existing scans. When proactive monitoring is enabled, AppScan on Cloud checks for new vulnerabilities every 24 hours.
    - Personal scans
      A personal scan is a way of evaluating the relative security of an application in development without affecting overall application scan data (issues, for example), or compliance.
  - Configuring a scan using AppScan Go!
    AppScan Go! steps you through configuring and running a static scan. Run the scan in the cloud or use a plugin to automate scanning.
  - Generating an IRX file using the command-line interface (CLI)
    To initiate an analysis of your files, you must generate an IRX file to submit for scanning. To use the CLI to generate the IRX file, follow these instructions.
  - Generating in IRX file using a plugin or IDE
  - Generating an IRX file using a Software Bill of Materials (SBOM) report
    Use the REST API to create an IRX file from a Software Bill of Materials (SBOM) report in SPDX 2.3 format.
  - Runtime Software Composition Analysis
    Identify and manage vulnerabilities in open source components and libraries used by an application at runtime.
- SCA scan results
  Features available in SCA scan results.
Static analysis
Use static analysis (SAST) to scan for security vulnerabilities in web and desktop applications. Static analysis includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
AI-powered security
AppScan on Cloud recognizes the increasing role of artificial intelligence in development protocols. Just as AI can speed and strengthen the application development process, so can AI be used to ensure those applications are secure and ready for market.
Results
The Scans and Sessions page lists the scans under the categories DAST, SAST, SCA, and IAST, where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.The Scans and Sessions page lists scans under the categories where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.
Troubleshooting
If you experience problems with this service, you can perform these troubleshooting tasks to determine the corrective action to take.
FAQ & Reference
Frequently asked questions, information about integrating ASoC into the product lifecycle (SDLC), and ASoC API documentation.

Onboarding multiple repositories for scanning

Configure connections to repositories from the Applications page for static analysis and Software Composition Analysis scanning.

You can onboard multiple repositories at once by connecting directly to external repository providers and selecting relevant repositories. Onboarding repositories in this manner creates applications associated with the repositories. During onboarding, you can configure and schedule scans.

To onboard repositories:

From the Applications page, click Onboard repositories.
Select a repository provider:
- GitHub Enterprise
- Bitbucket
- GitLab
Select an AppScan Presence from the available Presence list, and click Authorize Presence.
To setup an AppScan Presence for use with a repository, see one of the following topics:
Once the connection is confirmed, click Next: Mapping.
Choose the repositories to map to an asset group, then click Next.
Configure settings to be associated with the mapped repositories, then click Next.
- Asset group: The asset group that controls the associated applications.
- Scan technology: Static analysis (SAST) or Software Composition Analysis (SCA)
- Scan execution: Schedule scanning, scan now, or only link the repository to AppScan on Cloud
  When scheduling scanning, specify start date and time, and frequency.
Review your choices then click Initiate Onboarding.

HCL AppScan on Cloud creates an application for each connected repository.
When onboarding is complete, HCL AppScan on Cloud displays results. Click Done to exit the wizard.