Getting started
Welcome to the documentation for HCL AppScan 360°, where you can find information about how to install, maintain, and use this service.
Installation
Learn about AppScan 360° architecture and how to install the product.
Administration
Define users, applications, policies, and configure DevOps integrations.
Navigation
This section describes the items on the main AppScan 360° menu bar, with links to more detailed information.
Dynamic analysis
AppScan on Cloud performs security scans for web-applications for production, staging and development environments.
- About dynamic analysis (DAST)
  An AppScan 360° dynamic (DAST) scan consists of two stages: Explore and Test. Even though most of the scan process is seamless to the user, and no input is required until the scan is complete, understanding how dynamic scanning works can help you to better understand the role of scanning in your development process.
- Dynamic scanning (DAST)
  AppScan 360° can perform dynamic analysis of an application that runs in a browser or a web API. Use the configuration options available in AppScan 360°, or upload an AppScan Standard configuration (template file) or a full scan file.
- Recording traffic
  You can record traffic as Explore data for DAST scans using the AppScan Activity Recorder browser extension (for Chrome or Edge), the HCL AppScan Traffic Recorder proxy server, or AppScan Standard.
- HCL AppScan Traffic Recorder
  The HCL AppScan Traffic Recorder (DAST proxy) enables you to record traffic to use as Explore data. Traffic Recorder instances can be created on demand to record traffic that will later be used for a DAST scan.
- AppScan Standard
Static analysis
Use static analysis (SAST) to scan for security vulnerabilities in web and desktop applications. Static analysis includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
Results
The Scans and Sessions page lists scans under the categories where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.
Reference
Some frequently asked questions, and information about integrating AppScan 360° into the product lifecycle (SDLC).

Using AppScan Standard scans or templates

What is the benefit of using AppScan Standard?

If you have specific configuration requirements, you can configure and use your own AppScan Standard scan or scan template, and use it for your scan. A SCAN file is an actual AppScan scan with results; a SCANT file is an AppScan Standard configuration without results. You can use either as the basis of your AppScan 360° scan. You can also record and validate the login procedure only, save as a LOGIN file, and upload to use in your AppScan 360° scan.

Examples of specific cases where you might want to use a custom AppScan Standard SCAN, SCANT, or LOGIN file are:

The site has a complex login procedure that you want to record
You want to limit the scan to a specific part of the site
You want to use custom parameters
There are parts of the site that can only be reached by clicking links in a specific order

How to obtain AppScan Standard

Even without purchasing a license, you can use AppScan Standard to create configurations, upload configurations to run on AppScan 360°, and download results to review.

If you have an active AppScan 360° subscription, download AppScan Standard from FlexNet Operations Portal (FNO):
Download the current version of AppScan Standard
If you only have a trial account for AppScan 360°, you can request a trial version of AppScan Standard to use during your trial period:
Request a free AppScan Standard trial version