Welcome
Dynamic analysis
AppScan on Cloud performs security scans for web-applications for production, staging and development environments. For development environments it is aided by Private Site Scanning technology to scan applications not accessible to the open Internet.
Private sites
An AppScan Presence on your server enables you to scan sites not accessible from the Internet .
Custom proxy configuration
Route dynamic analysis (DAST) scan traffic to internal or private web applications through a designated forward proxy server as an alternative to an AppScan Presence.

Getting started
Welcome to the documentation for HCL AppScan on Cloud, where you can find information about how to install, maintain, and use this service.
Navigation
This section describes navigating AppScan on Cloud, including items on the side main menu and top navigation bars, with links to more detailed information.
Management
Define users, roles, groups, applications, policies, and configure DevOps integrations.
Dynamic analysis
AppScan on Cloud performs security scans for web-applications for production, staging and development environments. For development environments it is aided by Private Site Scanning technology to scan applications not accessible to the open Internet.
- About dynamic analysis (DAST)
  An ASoC dynamic (DAST) scan consists of two stages: Explore and Test. Even though most of the scan process is seamless to the user, and no input is required until the scan is complete, understanding how dynamic scanning works can help you to better understand the role of scanning in your development process.
- Dynamic scanning (DAST)
  ASoC can perform dynamic analysis of an application that runs in a browser or a web API. Use the configuration options available for a web application or web API in ASoC, or upload an AppScan Standard configuration (template file) or a full scan file.
- AppScan Presence
  An AppScan Presence on your server enables you to scan sites not accessible from the Internet, and to incorporate scanning as part of your functional testing.
- Recording traffic
  You can record traffic as Recorded explore data for DAST scans using the AppScan Activity Recorder browser extension (for Chrome or Edge), the HCL AppScan Traffic Recorder proxy server, or AppScan Standard.
- HCL AppScan Traffic Recorder
  The HCL AppScan Traffic Recorder (DAST proxy) enables you to record traffic to use as Explore data. Traffic Recorder instances can be created on demand to record traffic that will later be used for a DAST scan.
- IAST Total
  IAST Total (Interactive Application Security Testing), harnesses IAST capabilities to enhance Dynamic Analysis (DAST) scans, improving scan and remediation times while uncovering a broader spectrum of vulnerabilities.
- AppScan Standard
- Private sites
  An AppScan Presence on your server enables you to scan sites not accessible from the Internet .
  - Understand Private Site Scanning
    ASoC provides Dynamic Application Security Testing (DAST) from a cloud-based scanner as SaaScentralized on-premises serve. This capability requires the cloud-based scanner to be able to access the tested application. Publicly available web-based applications can be scanned without issue. However, Private Site Scanning (PSS) is only possible after adding network components (such as VPNs or proxies) or changing the network to allow the scanner to access the web application’s host server.
  - Custom proxy configuration
    Route dynamic analysis (DAST) scan traffic to internal or private web applications through a designated forward proxy server as an alternative to an AppScan Presence.
Interactive monitoring
Using an agent installed on your application, ASoC identifies security vulnerabilities in your application during runtime by monitoring all interactions, both legitimate and malicious. The process is "passive," in the sense that IAST does not send its own tests, and can therefore run indefinitely.
Software Composition Analysis
Use Software Composition Analysis (SCA) to scan for security vulnerabilities in open source and third-party packages used by your code.
Static analysis
Use static analysis (SAST) to scan for security vulnerabilities in web and desktop applications. Static analysis includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
AI-powered security
AppScan on Cloud recognizes the increasing role of artificial intelligence in development protocols. Just as AI can speed and strengthen the application development process, so can AI be used to ensure those applications are secure and ready for market.
Results
The Scans and Sessions page lists the scans under the categories DAST, SAST, SCA, and IAST, where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.The Scans and Sessions page lists scans under the categories where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.
Troubleshooting
If you experience problems with this service, you can perform these troubleshooting tasks to determine the corrective action to take.
FAQ & Reference
Frequently asked questions, information about integrating ASoC into the product lifecycle (SDLC), and ASoC API documentation.

Configuring a custom proxy for dynamic analysis

Route dynamic analysis (DAST) scan traffic to internal or private web applications through a designated forward proxy server as an alternative to an AppScan Presence.

Before you begin

Before you configure a custom proxy, confirm the following prerequisites:

The forward proxy server can reach the target application URL.
You have the fully qualified domain name (FQDN) or IP address and the listening port of your proxy server.
If the proxy server requires authentication, obtain the authorized username and password.

About this task

Custom proxy routing enables scan engines to test web applications hosted on private corporate networks or private cloud infrastructure without installing an AppScan Presence.

Important:

Mutual exclusivity: A scan configuration supports either an AppScan Presence or a custom proxy, but not both. Selecting a custom proxy disables the AppScan Presence selection for that scan.
Pre-scan validation bypass: When you enter proxy authentication credentials (username and password), AppScan on Cloud automatically bypasses automated pre-scan URL reachability validation to allow authentication handshakes during scan execution.

Procedure

Go to Scans and select an existing DAST scan configuration, or select Create scan > Dynamic analysis.
In the scan configuration wizard, go to the Environment or Connection tab.
Under private network routing options, select Custom Proxy.
In the Proxy Host / IP box, enter the FQDN or IP address of the forward proxy server.
In the Port box, enter the listening port of the proxy server.
(Optional) If the proxy requires authentication, enter the credentials in the Username and Password boxes.
Select Save to store the configuration, or select Scan to start the scan.

Results

AppScan on Cloud routes scan traffic through the configured forward proxy server to analyze the target private web application.

What to do next

If the scan fails to establish a connection, see AppScan Presence troubleshooting or verify that the proxy host accepts incoming requests from the AppScan on Cloud scanner IP range.