Configuration commands (Windows™)

• appscan prepare
• appscan package
• appscan get_pubkey

appscan prepare

Syntax:

appscan prepare -c <configuration_file> -d <save_path>  -jdk <jdk_path> -l <log_path> -n <file_name>  -s <value> -sco,--sourceCodeOnly  -t,--thirdParty -v,--verbose -X,--debug

Description:

Generate an IRX file.

Optional flags/settings:

• -c: This option is used for configuring a scan.
• -d: Specify -d <save_path>, where <save_path> is the directory that you want to save the IRX file to.
• -dr, --dryrun: Specify -dr or --dryrun to discover and validate scan targets, but not generate an .irx file.
• .jdk: Specify -jdk <jdk_path> to indicate the path to your JDK installation to be used in lieu of the default JDK 11. If using a config file (-c <configuration_file>) and the jdk_path attribute is used, the value specified in the config file takes precedence.
• -l: Specify -l <log_path>, where <log_path> is the directory that you want to save the log files to.
• -n: Specify -n <file_name>, where <file_name> is the IRX file name. You can specify the file name with or without the .irx file extension. If you specify it without the extension, it is automatically added for you when the file is generated.
• -s: Specify -s <value> to indicate scan speed and depth, where <value> is either simple, balanced, deep, or thorough. Scan speeds specified through the command line correspond to scan speeds that can be chosen in AppScan Go!
  • A simple scan performs a surface-level analysis of your files to identify the most pressing issues for remediation. It takes the least amount of time to complete.
  • A balanced scan provides a medium level of detail on the analysis and identification of security issues, and takes a bit more time to complete than the 'Simple' scan.
  • A deep scan performs a more complete analysis of your files to identify vulnerabilities, and usually takes longer to complete.
  • A thorough scan performs a comprehensive analysis to identify the most comprehensive list of vulnerabilities and will take the longest time to complete.
    Note: Scan speed does not necessarily correlate to relative number of vulnerabilities found in the code. For example, thorough analysis may rule out false positives that might be reported in a simple scan and therefore report fewer vulnerabilities.
  Note: This optional parameter is case-sensitive. When no scan speed is specified, the Client Utility performs a deep scan as a default.
• -sao: Specify -sao to perform static analysis only.
• -sco, --sourceCodeOnly: Specify -sco or --sourceCodeOnly to scan only source code files. This setting disables scanning other supported file types, such as .dll, .exe, .jar, .war, and others.

  Source-code only scans are useful when you only have access to the source code, you want to run a faster scan, or you prefer speed over depth of scan. Choose alternate scan options if you only have access to the build outputs, or if you prefer depth of scan over speed.

  Note: See Static Analysis Language Support for a list of included source code-only file types.
• -t, --thirdParty: By default, third-party Java and .NET code is not scanned during IRX file generation. You can modify third-party code exclusion settings by following the instructions in Managing third-party Java and .NET exclusions. To include third-party code, specify the -t or --thirdParty option when you issue the prepare command.

  If you are a developer of third-party code that would normally be excluded in a scan, you should use the setting to include the third-party code.

• -v,--verbose: Specify -v or --verbose to display more informational output during IRX file generation.
• -X,--debug: Specify -X or --debug to run the entire command in debug mode. When run in debug mode, more log files are generated for troubleshooting.

Examples:

To generate an IRX file that uses this configuration file, c:\my_config_files\my_config.xml - and that saves the IRX file to c:\my_irx_files\my_scan.irx - issue this command:

appscan prepare -c c:\my_config_files\my_config.xml -d c:\my_irx_files -n my_scan.irx

appscan package

Syntax:

appscan package -d <save_path> -f <assessment_file> -n <file_name>

Description:

Generate an IRX file that contains an assessment (.ozasmt) file that was created in an HCL AppScan Source Version 9.0 or higher product.

Optional flags/settings:

• -d: Specify -d <save_path>, where <save_path> is the directory that you want to save the IRX file to.
• -n: Specify -n <file_name>, where <file_name> is the IRX file name. You can specify the file name with or without the .irx file extension. If you specify it without the extension, it is automatically added for you when the file is generated.

Examples:

While in the c:\my_irx_files directory, you can generate an IRX file that contains this assessment file, c:\my_assessment_files\my_assessment.ozasmt, by issuing this command:

appscan package -f c:\my_assessment_files\my_assessment.ozasmt

The resulting IRX file is saved in c:\my_irx_files.

appscan get_pubkey

Syntax:

appscan get_pubkey -d <save_path>

Description:

Download the public encryption key for use on a computer that is not connected to the Internet.

If you are generating an IRX file from a computer that is connected to the Internet, this command is not required since an encryption key is automatically downloaded when you issue the prepare command. If an encryption key is already present on the computer, it is updated, if necessary, when you issue the prepare command.

However, if you are generating an IRX file from a computer that is not connected to the Internet, you can download the encryption key by using this command. You can then copy the encryption key to the computer that is not connected to the Internet for use when you generate the IRX file. To use the encryption key on that computer, you must preserve the rsa.pub file name and place the file in the config directory of the extracted SAClientUtil_<version>_<os>.zip file (where <version> is the current version of the Command Line Utility).

Optional flags/settings:

• -d: Specify -d <save_path>, where <save_path> is the directory that you want to save the encryption key to. If this option is not specified, the key is saved to the config directory of the extracted SAClientUtil_<version>_<os>.zip file.