Welcome
Dynamic analysis
HCL AppScan 360° performs security scans for web-applications for production, staging and development environments.
Dynamic scanning (DAST)
AppScan 360° can perform dynamic analysis of an application that runs in a browser or a web API. Use the configuration options available for a web application or web API in AppScan 360°, or upload an AppScan Standard configuration (template file) or a full scan file.
Intelligent Finding Analytics (IFA)
Intelligent Finding Analytics (IFA) uses artificial intelligence (AI) and machine learning (ML) to analyze data, discover patterns, and make predictions, ultimately transforming data into actionable insights. IFA goes beyond regular data analysis by using advanced methods to find deeper meanings and make smart decisions.
AI for smarter error detection
Intelligent Finding Analytics (IFA) in Dynamic Application Security Testing (DAST) augments error page detection by reducing false positives and enhancing test results. HCL AppScan DAST uses heuristic and comprehensive methods to identify error pages, with Gen AI now selectively employed to confirm errors and handle edge cases, thus increasing accuracy and minimizing scan times.

Getting started
Welcome to the documentation for HCL AppScan 360°, where you can find information about how to install, maintain, and use this service.
Installation
Learn about AppScan 360° architecture and how to install the product.
Navigation
This section describes the items on the main AppScan 360° menu bar, with links to more detailed information.
Administration
Define users, applications, policies, and configure DevOps integrations.
Dynamic analysis
HCL AppScan 360° performs security scans for web-applications for production, staging and development environments.
- About dynamic analysis (DAST)
  An AppScan 360° dynamic (DAST) scan consists of two stages: Explore and Test. Even though most of the scan process is seamless to the user, and no input is required until the scan is complete, understanding how dynamic scanning works can help you to better understand the role of scanning in your development process.
- Dynamic scanning (DAST)
  AppScan 360° can perform dynamic analysis of an application that runs in a browser or a web API. Use the configuration options available for a web application or web API in AppScan 360°, or upload an AppScan Standard configuration (template file) or a full scan file.
  - Creating a web application scan
    Provide the starting URL and user credentials for the scan, select the type of site, and (if not previously done) verify your permission to scan the site.
  - Creating an API scan
    AppScan 360° supports different workflows for scanning a web API. If you have a Postman collection, OpenAPI specification file or recorded traffic of your web API, you can import it and use it as the basis for a scan by using the API scan configuration. Alternatively, you can use the Postman collection files or the OpenAPI specification files with the REST API.
  - Creating scan from template
    You can upload your own AppScan Standard template (SCANT) file to run an AppScan 360° scan.
  - Creating scan from scan file
    You can upload your own AppScan Standard scan (SCAN) file to run an AppScan 360° scan.
  - Creating an Incremental scan
  - Test policies
    The test policies is a list of web application security scan settings. You can select one of the predefined test policies available when running scans from the ASoC user interface, but other policies can be applied with imported scans or scans run from the API. You can also upload custom test policies that you created in AppScan Standard and AppScan Enterprise.
  - Test optimization
    Test optimization uses intelligent finding analytics (IFA) to achieve faster scans with minimal loss of issue coverage. When speed is a consideration, choose between four optimization levels.
  - Test automation
    Incorporate dynamic scanning in your functional testing.
  - Client certificates
  - Intelligent Finding Analytics (IFA)
    Intelligent Finding Analytics (IFA) uses artificial intelligence (AI) and machine learning (ML) to analyze data, discover patterns, and make predictions, ultimately transforming data into actionable insights. IFA goes beyond regular data analysis by using advanced methods to find deeper meanings and make smart decisions.
    - AI for smarter error detection
      Intelligent Finding Analytics (IFA) in Dynamic Application Security Testing (DAST) augments error page detection by reducing false positives and enhancing test results. HCL AppScan DAST uses heuristic and comprehensive methods to identify error pages, with Gen AI now selectively employed to confirm errors and handle edge cases, thus increasing accuracy and minimizing scan times.
    - Test optimization
      Test optimization uses intelligent finding analytics (IFA) to achieve faster scans with minimal loss of issue coverage. When speed is a consideration, choose between four optimization levels.
- Recording traffic
  You can record traffic as Recorded explore data for DAST scans using the AppScan Activity Recorder browser extension (for Chrome or Edge), the HCL AppScan Traffic Recorder proxy server, or AppScan Standard.
- HCL AppScan Traffic Recorder
  The HCL AppScan Traffic Recorder (DAST proxy) enables you to record traffic to use as Explore data. Traffic Recorder instances can be created on demand to record traffic that will later be used for a DAST scan.
- IAST Total
  IAST Total (Interactive Application Security Testing), harnesses IAST capabilities to enhance Dynamic Analysis (DAST) scans, improving scan and remediation times while uncovering a broader spectrum of vulnerabilities.
- AppScan Standard
- Troubleshooting Dynamic Analysis
Interactive monitoring
Using an agent installed on your application, AppScan 360° identifies security vulnerabilities in your application during runtime by monitoring all interactions, both legitimate and malicious. The process is "passive," in the sense that IAST does not send its own tests, and can therefore run indefinitely.
Software Composition Analysis
Use Software Composition Analysis (SCA) to scan for security vulnerabilities in open source and third-party packages used by your code. SCA includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
Static analysis
Use static analysis (SAST) to scan for security vulnerabilities in web and desktop applications. Static analysis includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
Results
The Scans and Sessions page lists the scans under the categories DAST, SAST, SCA, and IAST, where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.The Scans and Sessions page lists scans under the categories where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.
Reference
Some frequently asked questions, and information about integrating AppScan 360° into the product lifecycle (SDLC).

AI for smarter error page detection

Intelligent Finding Analytics (IFA) in Dynamic Application Security Testing (DAST) augments error page detection by reducing false positives and enhancing test results. HCL AppScan DAST uses heuristic and comprehensive methods to identify error pages, with Gen AI now selectively employed to confirm errors and handle edge cases, thus increasing accuracy and minimizing scan times.

Procedure

Navigate to Organization > Settings > Scans.
Click the Disabled toggle button to enable Azure OpenAI configuration.

Note: Azure OpenAI services incur costs based on token usage (input and output). Follow best practices and regularly monitor usage to ensure cost efficiency.

Enter the Endpoint in the following format: https://{azure_openai_endpoint}/openai/deployments/{deployment_name}/chat/completions

Table 1. Endpoint elements
Element	Description	Example
`{azure_openai_endpoint}`	Substitute with the value from the Endpoint field under the Keys & Endpoint section from the Azure portal.	`https://aoairesource.openai.azure.com`
`{deployment_name}`	Corresponds to the custom name you chose for your deployment when you deployed a model. You can get this value from Azure OpenAI Studio of your Azure portal. Note: Azure OpenAI testing was conducted using GPT-4o, version 2024-08-06. We recommend using this specific model and version to avoid any failures.	`GPT-4o`
Example of endpoint: `https://aoairesource.openai.azure.com/openai/deployments/GPT-4o/chat/completions`

Enter the API Key. This value can be found in the Keys & Endpoint section when examining your resource from the Azure portal. You can use either KEY1 or KEY2.

CAUTION: Ensure both the Endpoint and API Key values are correct, as there is no validation to catch typos or errors.
Click Save to apply the configuration for your organization.
The Azure OpenAI endpoint and API key have been configured.

What to do next

Start your scan in AppScan 360° as usual.