Automated Application Scanning
This tutorial aims to automate a security scan on your application in a CI/CD environment. See section Scanning an Application for more details.
Adding a New Application
Login into the FortiDevSec portal and add a new application for your organization.
- Click on the New Application tab and enter the application name.
- Click Next and the App Setup information is displayed, copy the Application UUID and Org ID.
You can optionally configure the risk ratings for your application. See section Adding a New Application for detailed procedure.
Writing the fdevsec.yaml
Write the fdevsec.yaml file and integrate it into your CI/CD as defined in the next step (based on the CI/CD tool). This tutorial uses only the mandatory parameters in the configuration file, you can add optional (advanced) parameters to make your scan more precise.
The App ID and the Org ID are the only mandatory parameters.
version: v1
id:org: 6a4d32db-6751-441a-88fe-9b4793717cde
app: aa8a393b-afc6-47d7-84d2-b7011f1d0012
The application languages are automatically detected and FortiDevSec runs the appropriate scans, namely, SAST, SCA, and Secret.
See section Configuring the Scanner (fdevsec.yaml) for detailed procedure.
CI/CD Configurations
Integrate scan configurations into your CI/CD tool. See Running the Security Scan.
Viewing the Scan Result
The dashboard of the FortiDevSec portal lists the applications, click on your application to view and analyze comprehensive details of the detected vulnerabilities.
See section Viewing the Scan Result for more details.