Configuring the Scanner (fdevsec.yaml)

Check-in or add the fdevsec.yaml file into the root folder of the application source code.

Note: Do NOT modify the name and format of this file.

FortiDevSec automatically detects your application languages and runs the relevant scans. However, to run DAST scans additional parameters are required in fdevsec.yaml, these are described later on in this section. You can also optionally add advanced settings to fdevsec.yaml file as per your requirements.

The following is a sample fdevsec.yaml file, the contents of this file vary based on different application scanning requirements.

version: v1

id: org: 6a4d32db-6751-441a-88fe-9b4793717cde app: aa8a393b-afc6-47d7-84d2-b7011f1d0012

# Optional parameters.
scanners: - sast - dast - secret - sca - iac - container

languages: - python - javascript

dast: url: <your.url.com> full_scan: true #true|false

resource: serial_scan: true #true|false

fail_pipeline: risk_rating: <1–9>

The following are the mandatory and optional parameters for fdevsec.yaml.

Parameter	Description
Mandatory parameters
org	A unique ID associated with your organization.
app	A unique ID that identifies the applications within the organization.
Optional Parameters
scanners	This identifies the type of scanner to test the applications. The supported values are sast, dast, sca, secrets, iac, and container. Notes: If this parameter is unspecified, FortiDevSec runs only static scans. To run DAST scan, use DAST image with the `url` parameter specified in the configuration file.
languages	Specify the language that you want to scan. The supported values are java, javascript, python, golang, php, ruby, c++, shell, and c. FortiDevSec automatically detects the language if this parameter is not specified. Note: Specifying languages as javascript also scans NodeJS code.
dast	Specify these parameters if you intend running a DAST scan on your application. `url` - The URL where your application is hosted. `full_scan` - The supported values are true and false(default). When set to true, a full DAST scan is run and when set to false, a basic scan is run. Note: You can configure the FortiDAST scanner with specific parameters for testing your asset (URL). For details on scanner configuration see the FortiDAST documentation.
resource	When `serial_scan` is set to `true`, the scans run consecutively and when set to `false`, multiple scans run parallel. The default value of `serial_scan` is true.
fail pipeline	Specify the `risk_value` parameter if you intend to fail CI/CD pipeline based on your risk tolerance level. If the resulting risk rating value after scan is greater than or equal to the defined value, the CI/CD pipeline fails. The CI/CD pipeline tool will automatically detect the failure and will stop the pipeline process. `risk_value` - The supported value is a number in the range of 1–9; 1 indicates the lowest and 9 the highest risk rating level.

Configuring the Scanner (fdevsec.yaml)

Check-in or add the fdevsec.yaml file into the root folder of the application source code.

Note: Do NOT modify the name and format of this file.

The following is a sample fdevsec.yaml file, the contents of this file vary based on different application scanning requirements.

version: v1

id:
  org: 6a4d32db-6751-441a-88fe-9b4793717cde
  app: aa8a393b-afc6-47d7-84d2-b7011f1d0012

# Optional parameters.

scanners:
  - sast
  - dast
  - secret
  - sca
  - iac
  - container

languages:
  - python
  - javascript

dast:
  url: <your.url.com>
  full_scan: true #true|false

resource:
  serial_scan: true #true|false

fail_pipeline:
  risk_rating: <1–9>

The following are the mandatory and optional parameters for fdevsec.yaml.

Parameter	Description
Mandatory parameters
org	A unique ID associated with your organization.
app	A unique ID that identifies the applications within the organization.
Optional Parameters
scanners	This identifies the type of scanner to test the applications. The supported values are sast, dast, sca, secrets, iac, and container. Notes: If this parameter is unspecified, FortiDevSec runs only static scans. To run DAST scan, use DAST image with the `url` parameter specified in the configuration file.
languages	Specify the language that you want to scan. The supported values are java, javascript, python, golang, php, ruby, c++, shell, and c. FortiDevSec automatically detects the language if this parameter is not specified. Note: Specifying languages as javascript also scans NodeJS code.
dast	Specify these parameters if you intend running a DAST scan on your application. `url` - The URL where your application is hosted. `full_scan` - The supported values are true and false(default). When set to true, a full DAST scan is run and when set to false, a basic scan is run. Note: You can configure the FortiDAST scanner with specific parameters for testing your asset (URL). For details on scanner configuration see the FortiDAST documentation.
resource	When `serial_scan` is set to `true`, the scans run consecutively and when set to `false`, multiple scans run parallel. The default value of `serial_scan` is true.
fail pipeline	Specify the `risk_value` parameter if you intend to fail CI/CD pipeline based on your risk tolerance level. If the resulting risk rating value after scan is greater than or equal to the defined value, the CI/CD pipeline fails. The CI/CD pipeline tool will automatically detect the failure and will stop the pipeline process. `risk_value` - The supported value is a number in the range of 1–9; 1 indicates the lowest and 9 the highest risk rating level.

Parameter

Description

Mandatory parameters

org

A unique ID associated with your organization.

app

A unique ID that identifies the applications within the organization.

Optional Parameters

scanners

This identifies the type of scanner to test the applications. The supported values are sast, dast, sca, secrets, iac, and container.

Notes:

If this parameter is unspecified, FortiDevSec runs only static scans.
To run DAST scan, use DAST image with the url parameter specified in the configuration file.

languages

Specify the language that you want to scan. The supported values are java, javascript, python, golang, php, ruby, c++, shell, and c.

FortiDevSec automatically detects the language if this parameter is not specified.

Note: Specifying languages as javascript also scans NodeJS code.

dast

Specify these parameters if you intend running a DAST scan on your application.

url - The URL where your application is hosted.
full_scan - The supported values are true and false(default). When set to true, a full DAST scan is run and when set to false, a basic scan is run.
Note: You can configure the FortiDAST scanner with specific parameters for testing your asset (URL). For details on scanner configuration see the FortiDAST documentation.

resource

When serial_scan is set to true, the scans run consecutively and when set to false, multiple scans run parallel. The default value of serial_scan is true.

fail pipeline

Specify the risk_value parameter if you intend to fail CI/CD pipeline based on your risk tolerance level. If the resulting risk rating value after scan is greater than or equal to the defined value, the CI/CD pipeline fails. The CI/CD pipeline tool will automatically detect the failure and will stop the pipeline process.

risk_value - The supported value is a number in the range of 1–9; 1 indicates the lowest and 9 the highest risk rating level.

User Guide

Configuring the Scanner (fdevsec.yaml)

Configuring the Scanner (fdevsec.yaml)

Configuring the Scanner (fdevsec.yaml)