Jenkins Setup

Integrate the FortiDAST plugin with Jenkins to trigger vulnerability assessment scans as part of the build process. Click here to download the FortiDAST plugin.

Perform the following steps to install the FortiDAST plugin for Jenkins.

1. In the Jenkins GUI, navigate to Manage Jenkins > Manage Plugins. The Plugin Manager page is displayed.
2. On the Jenkins Plugin Manager page, click on the Available tab and search FortiDAST.
3. Select the FortiDAST plugin.
4. Click on Install without restart.
   

(Optional) When the installation is complete, select Restart Jenkins when installation is complete and no jobs are running.

Perform the following steps to add the FortiDAST SSL certificate to the Jenkins.

1. Download FortiDAST SSL certificate and locate the certificate store path to install it in the Jenkins CA store.
2. Identify the JAVA_HOME_FOLDER used by the Jenkins service (The executable tag Jenkins.xml file in the installation directory gives the location of Java folder used by Jenkins).
3. To install the SSL certificate in Windows, navigate to the bin folder and run the following command.
   keytool -import -trustcacerts -alias FortidastCA -keystore "C:\Program Files\Java\jdk-11.0.10\lib\security\cacerts" -file “<FortiDAST SSL Certs Location Path>”.

Perform the following steps to integrate FortiDAST and Jenkins.

1. In the Jenkins GUI, navigate to Dashboard > Manage Jenkins > Configure System and scroll down to the FortiDAST plugin.
2. Verify the FortiDAST API URL that is auto-populated after the plugin installation. The default URL is https://fortidast.com/api/v1.0.
3. Enter the FortiDAST server UserName.
4. Validate the user name and click Apply.
   
   

Perform the following steps to add the FortiDAST Build Step in a Jenkins Job. You can modify an existing job or create a new job. Obtain the API key from FortiDAST GUI. See section REST API.

Note: Only the Privileged key is supported.

1. In the Jenkins job, scroll down to Build, select FortiDAST as the Build Step and update the following.

   • Scan Type - Select Quick Scan or Full Scan for your asset.

   • API Key - Click Add to add credentials and update; select Secret text as the Kind, enter the API key in the Secret field, and enter a unique ID.
   
   

2. Select the ID from the API Key, the assets associated with the FortiDAST account (user name) are populated in the Scan Target field.
3. Select the asset to be scanned in the Scan Target field.
   
   
4. Click Save.

Click Build Now, a scan is triggered on the asset. After the scan is complete, you can view the Scan Summary Report in Jenkins.