IBM Application Security on Cloud Maven Plugin

Generate an IRX file for use with IBM Application Security on Cloud

License	Apache License, Version 2.0
Categories	Maven Build Tools Security
GroupId	com.ibm.security
ArtifactId	appscan-maven-plugin
Last Version	1.0.2
Release Date	May 17, 2019
Type	maven-plugin
Description	IBM Application Security on Cloud Maven Plugin Generate an IRX file for use with IBM Application Security on Cloud
Project URL	https://www.ibm.com/us-en/marketplace/application-security-on-cloud
Source Code Management	https://github.com/hclproducts/appscan-maven-plugin

Download appscan-maven-plugin

Filename	Size
appscan-maven-plugin-1.0.2.pom
appscan-maven-plugin-1.0.2.jar	26 KB
appscan-maven-plugin-1.0.2-sources.jar	16 KB
appscan-maven-plugin-1.0.2-javadoc.jar	100 KB

How to add to project

Apache Maven

<plugin>
    <groupId>com.ibm.security</groupId>
    <artifactId>appscan-maven-plugin</artifactId>
    <version>1.0.2</version>
</plugin>

Dependencies

compile (4)

Group / Artifact	Type	Version
org.apache.maven : maven-plugin-api	jar	3.1.1
org.apache.maven.plugin-tools : maven-plugin-annotations	jar	3.2
org.apache.maven : maven-core	jar	3.0
com.hcl : appscan.sdk	jar	1.0.9

test (1)

Group / Artifact	Type	Version
junit : junit	jar	4.8.2

Project Modules

There are no modules declared in this project.

HCL AppScan on Cloud Maven Plugin

Apply the power of static application security testing with HCL AppScan on Cloud – a SaaS solution that helps to eliminate vulnerabilities from applications before they are deployed. HCL AppScan on Cloud integrates directly into the SDLC, providing static, dynamic, mobile and open source testing.

You can submit static and open source scans directly from the HCL AppScan on Cloud Maven plugin or use it to generate an IRX file for later submission to the service. The results are ready quickly (90% are ready in less than one hour) having been honed by Intelligent Finding Analytics, which uses HCL's Artificial Intelligence capabilities to greatly reduce false positives and other noise by an average of more than 98%. IFA also displays optimal locations for developers to fix multiple vulnerabilities in the code. Click here for more information.

Not yet a customer of HCL AppScan on Cloud? Click here for a free trial of Application Security on Cloud to use with this plugin

Prerequisites:

• An account on the HCL AppScan on Cloud service. You'll need to create an application on the service to associate your scans with.

Goals:

• prepare: Generates an IRX file for all jar, war, and ear projects in the build. The IRX file will be generated in the root project's "target" directory by default.
• analyze: Generates an IRX file for all jar, war, and ear projects in the build and submits it to the HCL AppScan on Cloud service for analysis. This task requires an api key, secret, and application id. The IRX file will be generated in the root project's "target" directory by default.
• listTargets: Lists the targets that will be included in the generated .irx file.

Usage:

To execute the "prepare" goal, run the following command:

mvn com.hcl.security:appscan-maven-plugin:prepare

To execute the "analyze" goal, run the following command:

mvn com.hcl.security:appscan-maven-plugin:analyze

This goal requires the appId, appscanKey, and appscanSecret paramaters.

Note: The above commands can be simplified by adding com.hcl.security to the list of plugin groups in your Maven settings.xml. To do so, add the following to ~/.m2/settings.xml or ${maven.home}/conf/settings.xml:

<pluginGroups>
  <pluginGroup>com.hcl.security</pluginGroup>
</pluginGroups>

After doing so, you can execute the prepare goal using the "appscan" prefix. For example:

mvn appscan:prepare

Configurable Options:

OPTION:			DEFAULT VALUE					DESCRIPTION
output		<root project>/target/<root project name>.irx	The name and/or location of the generated .irx file. If the selected path does not exist, the default path is applied.
appId		null - Required for 'analyze' goal		The id of the application in the cloud service.
appscanKey	null - Required for 'analyze' goal        	The user's API key id for authentication.
appscanSecret	null - Required for 'analyze' goal        	The user's API key secret for authentication.
namespaces	null						Override automatic namespace detection. Set to "" to disable namespace detection.

License

All files found in this project are licensed under the Apache License 2.0.

HCL Products & Platforms

These repositories have been transferred to https://github.com/HCL-TECH-SOFTWARE

Versions

Version
1.0.2 May 17, 2019
1.0.1 Sep 18, 2018
1.0.0 Aug 29, 2018