Welcome
Results
The Scans and Sessions page lists the scans under the categories DAST, SAST, SCA, and IAST, where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.The Scans and Sessions page lists scans under the categories where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.
Rescanning
After you fix identified vulnerabilities, you can rescan the same application multiple times to verify your fixes and overwrite previous results. For DAST scans, you can choose from three scan modes: Full scan for complete coverage, Retest only to confirm fixes, or Incremental scan for changed areas only. For SAST and SCA scans, you can upload an updated archive file.
Retesting DAST issues
Retest single or multiple dynamic analysis (DAST) issues directly from scan details to verify vulnerability remediation without running a complete rescan.

Getting started
Welcome to the documentation for HCL AppScan on Cloud, where you can find information about how to install, maintain, and use this service.
Navigation
This section describes navigating AppScan on Cloud, including items on the side main menu and top navigation bars, with links to more detailed information.
Management
Define users, roles, groups, applications, policies, and configure DevOps integrations.
Dynamic analysis
AppScan on Cloud performs security scans for web-applications for production, staging and development environments. For development environments it is aided by Private Site Scanning technology to scan applications not accessible to the open Internet.
Interactive monitoring
Using an agent installed on your application, ASoC identifies security vulnerabilities in your application during runtime by monitoring all interactions, both legitimate and malicious. The process is "passive," in the sense that IAST does not send its own tests, and can therefore run indefinitely.
Software Composition Analysis
Use Software Composition Analysis (SCA) to scan for security vulnerabilities in open source and third-party packages used by your code.
Static analysis
Use static analysis (SAST) to scan for security vulnerabilities in web and desktop applications. Static analysis includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
AI-powered security
AppScan on Cloud recognizes the increasing role of artificial intelligence in development protocols. Just as AI can speed and strengthen the application development process, so can AI be used to ensure those applications are secure and ready for market.
Results
The Scans and Sessions page lists the scans under the categories DAST, SAST, SCA, and IAST, where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.The Scans and Sessions page lists scans under the categories where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.
- Scan data
- Issues
  The Issues page for an application, by default displays non-compliant issues only. You can apply a variety of filters to see the issues you need, and click on any issue to open the detailed issue information pane.
- Correlation
  AppScan analyzes issues found by IAST, DAST and SAST to identify common weak links in the code (correlations) where multiple vulnerabilities can be resolved with a single or consolidated remediation effort.
- Fix groups
  Fix groups currently apply only to issues found in static analysis scans.
- Reports
  Generate reports for issues discovered in applications. Send reports to send to developers, internal auditors, penetration testers, managers, and the CISO. Security information might be extensive, and can be filtered depending on your requirements.
- Remediation
  After risks are determined and vulnerabilities are prioritized, your security team can start the remediation process.
- Rescanning
  After you fix identified vulnerabilities, you can rescan the same application multiple times to verify your fixes and overwrite previous results. For DAST scans, you can choose from three scan modes: Full scan for complete coverage, Retest only to confirm fixes, or Incremental scan for changed areas only. For SAST and SCA scans, you can upload an updated archive file.
  - DAST retest only scan
    A DAST retest-only scan checks only the areas where vulnerabilities were previously detected. Use this mode to quickly confirm that your fixes resolved the identified issues.
  - Retesting DAST issues
    Retest single or multiple dynamic analysis (DAST) issues directly from scan details to verify vulnerability remediation without running a complete rescan.
  - DAST Edit configuration
    You can fix issues and rescan an application, overwriting previous results. Before rescanning, you can edit the scan configuration.
- IAST scan results
  An interactive (IAST) scan entry shows results since the last time the scan was started.
Troubleshooting
If you experience problems with this service, you can perform these troubleshooting tasks to determine the corrective action to take.
FAQ & Reference
Frequently asked questions, information about integrating ASoC into the product lifecycle (SDLC), and ASoC API documentation.

Retesting dynamic analysis issues

Retest single or multiple dynamic analysis (DAST) issues directly from scan details to verify vulnerability remediation without running a complete rescan.

Before you begin

To run a targeted issue retest, verify that:

You have scan execution permissions for the application or asset group.
All issues selected for a batch retest originate from the exact same scan. You can't combine issues across multiple scans into a single retest.
The parent scan completed or partially completed with the testing phase initiated.

About this task

Targeted issue retesting executes a focused dynamic test against only the specific URLs, parameters, and vulnerability payload tests associated with the chosen issues. It uses the scan configuration from the parent scan and updates the vulnerability status across both the scan view and the application dashboard upon completion.

Note:

You can trigger targeted issue retests only from the Issues tab of an individual scan details view (Scans > Scan Details > Issues). This option is not available from the aggregated, application-level issues inventory.

Procedure

Go to Scans and select the completed DAST scan that contains the findings you want to verify.
Select the Issues tab to view findings specific to that scan run.
Choose one of the following methods to start the retest:
- Table action bar (single or batch issues): Select the checkboxes next to the issues that you want to retest, and then select Retest on the table action bar.
- Issue details menu (single issue): Select an individual issue row to open the details pane, select the More Actions menu (), and then select Retest.
In the confirmation dialog, select Retest to start execution.

Results

AppScan on Cloud runs the focused test against the selected vulnerabilities. When the retest finishes, the issue lifecycle status updates automatically (for example, to Remediated or Open) in both the scan details and the application dashboard.