Welcome
Administration
Define users, applications, policies, and configure DevOps integrations.
DevOps
Tools for incorporating AppScan 360° in your software development lifecycle.
Integrations
Setting up an AppScan Presence to scan a GitHub repository directly
You can use an AppScan Presence to run static analysis on GitHub Enterprise repositories.
AppScan Presence
An AppScan Presence on your server enables you to scan sites not accessible from the Internet, and to incorporate scanning as part of your functional testing.

Getting started
Welcome to the documentation for HCL AppScan 360°, where you can find information about how to install, maintain, and use this service.
Installation
Learn about AppScan 360° architecture and how to install the product.
Navigation
This section describes the items on the main AppScan 360° menu bar, with links to more detailed information.
Administration
Define users, applications, policies, and configure DevOps integrations.
- Users
  User management allows you to control access to sensitive applications by assigning them to asset groups and then adding specific users to those groups.
- Applications
  An application is a collection of scans related to the same project. It can be a web site, a desktop app, a mobile app, a web service, or any component of an app. Applications enable you to asses risk, identify trends, and make sure that your project is compliant with industry and organization policies.
- Compliance policies
  You can apply the predefined compliance policies, as well as your own custom compliance policies, to show only data for the issues that are relevant for you.
- DevOps
  Tools for incorporating AppScan 360° in your software development lifecycle.
  - REST API
    The built-in REST API interface provides you with a way to visualize RESTful web services. The API documentation is built using Swagger, where you can test API operations and instantly view the results to help you scan your applications faster.
  - Webhooks
    Webhooks can be used to receive notifications about events that occur in AppScan 360°.
  - Environment status API
    The environment status API provides a way to monitor environment health and resource availability. The API documentation is built using Swagger, where you can test API operations and instantly view the results to help you maintain the health of your AppScan 360° environment.
  - Integrations
    - Adding security analysis to your Jenkins automation server
      The HCL AppScan Jenkins plug-in allows you to add security scan support to your Jenkins projects.
    - Installing and using the Azure DevOps Services plugin
      This task describes how to install and use the Azure DevOps Services plugin for running static or dynamic scans in your Azure DevOps Services and Team Foundation Server (TFS) pipelines. (Azure DevOps Services was previously known as Visual Studio Team Services (VSTS)).
    - Setting up an AppScan Presence to scan a GitHub repository directly
      You can use an AppScan Presence to run static analysis on GitHub Enterprise repositories.
      - AppScan Presence
        An AppScan Presence on your server enables you to scan sites not accessible from the Internet, and to incorporate scanning as part of your functional testing.
        System requirements
        Creating the Presence
        For private web applications, or for including a scan as part of your functional testing procedure, you must create an AppScan Presence, with access to the web application or back-end server, and to the Internet. Proxy connections are supported.
        Starting the Presence
        Configuring Private Site Server proxy
        If your private network requires the Private Site Server to use a proxy to connect with the web application or back-end server (internal proxy), or with the Internet (outgoing proxy), configure it as follows.
        Configuring a PAC file
        If a proxy auto-config (PAC) file is required in order to reach the various domains in your site, configure the AppScan Presence as follows.
        Renewing the Presence key
        When you originally download the Presence, it includes a key to activate it. When that key expires, you must replace it with a valid key.
        Log files
        AppScan Presence troubleshooting
        Troubleshooting tasks for errors found when working with the AppScan Presence.
- Personal scans
  A personal scan is a way of evaluating the relative security of an application in development without affecting overall application scan data (issues, for example), or compliance.
- Scan status
- Audit trail
  The audit trail (Organization > Audit trail) logs user activity.
Dynamic analysis
HCL AppScan 360° performs security scans for web-applications for production, staging and development environments.
Interactive monitoring
Using an agent installed on your application, AppScan 360° identifies security vulnerabilities in your application during runtime by monitoring all interactions, both legitimate and malicious. The process is "passive," in the sense that IAST does not send its own tests, and can therefore run indefinitely.
Software Composition Analysis
Use Software Composition Analysis (SCA) to scan for security vulnerabilities in open source and third-party packages used by your code. SCA includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
Static analysis
Use static analysis (SAST) to scan for security vulnerabilities in web and desktop applications. Static analysis includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
Results
The Scans and Sessions page lists the scans under the categories DAST, SAST, SCA, and IAST, where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.The Scans and Sessions page lists scans under the categories where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.
Reference
Some frequently asked questions, and information about integrating AppScan 360° into the product lifecycle (SDLC).

AppScan Presence

An AppScan Presence on your server enables you to scan sites not accessible from the Internet, and to incorporate scanning as part of your functional testing.

Important: AppScan 360° supports AppScan Presences for scanning a GitHub repository only. AppScan Presences are not supported for DAST scanning or other SAST scanning in AppScan 360°.

For web applications that are not accessible from the Internet you must create an AppScan Presence, with access to the web application or back-end server, and to the Internet, to be able to scan. Then follow the regular instructions for dynamic scanning. Proxy connections are supported.