Express installation of AppScan 360° on a single virtual machine

Express install allows you to test AppScan 360° with a limited configuration for testing AppScan 360° prior to a full install. It is essentially a "proof-of-concept" (PoC) install. You can install the single VM in either offline or online mode.

Note: Perform all installation and configuration activities as an Administrator on the target system.
To express install AppScan 360° on a single virtual machine:
  1. The AppScan 360° single VM setup script asks a series of questions to configure your environment. Review the setup information at Setting up the single VM environment and gather the information you will need to complete the installation.

  2. Download the AppScan 360° single VM script and the AppScan 360° installation files from MyHCLSoftware portal to a single directory location under /home/username. For example, /home/username/AppScan360_singleVM.
    Files included in the directory should be:
    • Either:
      • AppScan360_SingleVMsetup_v2.0.0.run
      • AppScan360_SingleVMsetup_v2.0.0_Offline.run
    • AppScan360_v2.0.0.run
    • AppScan360_ASRA_v2.0.0.run
    • AppScan360_SCA_v2.0.0.run (Optional)
  3. Create a directory for installation and move all files there. All installation kit files must be in the same directory.
    mkdir -p ~/aio-setup
    mv *.run ~/aio-setup/
  4. In the installation folder, provide executable permission to the installer by running:
    cd ~/aio-setup
    chmod +x *.run
  5. If you use custom or self-signed certificates for services such as SSO (LDAP, OIDC) or SMTP, prepare the certificates folder.
    sudo ./AppScan360_SingleVMsetup_v2.0.0.run -- $PWD prepareCertsFolders
    The command creates the following folder structure:
    Folder Function
    ~/aio-setup/certs/ Main certificates folder
    ~/aio-setup/certs/docker/ Docker Registry certificates (not needed for Express/PoC install)
    ~/aio-setup/certs/ldap/ LDAP certificates (for LDAPS support)
    ~/aio-setup/certs/smtp/ SMTP certificates (for SMTPS support)
    ~/aio-setup/certs/oidc/ OIDC certificates (for OIDCS support)
    ~/aio-setup/certs/ingress/ Ingress certificates (optional, self-signed will be generated if not provided)
    Important: After creating the folder structure, place certificates in the appropriate folders before proceeding.
  6. Run the install script:
    Note: Specify the folder location of the files, even though you are installing from the folder location.
    cd ~/aio-setup
    sudo ./AppScan360_SingleVMsetup_v2.0.0.run -- $PWD
    Note:
    • To stop the install for any reason, press CTRL+C, then run
      cd aioWorkspace
      ./disengageAS360-AIO.sh
    • Installation log files are located at ./aioWorkspace/logs
  7. When prompted, type 1 to specify Express/PoC installation. Press Enter.
  8. To verify system resources accurately, the procedure asks if you want to include Software Composition Analysis (SCA) in the installation.
    Do you want to install the optional SCA kit for this evaluation? (y/n)?
    Default is n.
    • y: Include the Software Composition Analysis (SCA) component in your installation. SCA allows you to analyze applications for open-source component vulnerabilities.
    • n: Do not enable the Software Composition Analysis (SCA) component in your installation.
    Based on your response, the procedure analyzes system resources and indicated whether the system meets minimum requirements for use, considering single concurrency scanning for DAST, SAST, IAST, and, if selected, SCA. The procedure notes calculated resource requirements and warns you if resources are insufficient.
  9. The installation procedure asks a series of questions, and asks you to confirm each answer. Respond to the questions and prompts as requested:
    1. > Please enter the primary domain name for this instance.

      This is a required field with no default value. The domain name specified is used to create the access URL for your AppScan 360° instance. For example, if you enter appscan-test.local, your AppScan 360° URL will be https://hostname.appscan-test.local.

      The domain name should be easy to remember, unique within your network environment, and should not conflict with existing domains.

    2. > Provide the external domain(s) or IP address(es) this instance must access for external services (e.g., SSO, SMTP). Use commas to separate multiple values. If none, press Enter to skip:

      Enter any domains or IP addresses that your AppScan 360° instance needs to connect to, such as:

      • SMTP servers for email notifications

      • SSO authentication providers (LDAP, OIDC)

      • External CI/CD tools

      Separate multiple entries with commas. Leave empty if no external services are needed.

    3. > Is the VM connected with the local DNS server (y/n)? 

      Default is n.

      • y: Your VM is connected to a DNS server. The system use the hostname for network-related configurations.
      • n: Your VM is not connected to a DNS server. The system uses IP addresses directly for network-related configurations.
    4. > A small amount of storage is required for your evaluation. We will allocate a default of 20 GB to accommodate all chosen components. Press Enter to accept 20 GB or specify a different size:
      This storage is used for logs, configuration files, and persistent data shared between components. Default is 20GB.
      • Press Enter to accept the default value, or,
      • Type in a different number to specify a custom storage value and press Enter.
    5. > Do you want to connect with your SMTP Mail Relay (SMR)(y/n)? 

      Default is n.

      An SMTP mail relay is an intermediary server that accepts outgoing emails from your system and forwards them to the recipients' email servers. The relay helps ensure email delivery and can apply certain rules like spam filtering. In AppScan 360°, setup a relay to receive notification emails when a scan is completed, if a scheduled scan kicked off, and so on.

      • y: Integrate AppScan 360° with an SMTP Mail Relay for sending emails from the deployment. When you choose y, enter the appropriate host, port, credentials, and encryption details when prompted for the SMR to complete the connection:
        • > Please enter the SMTP host:
        • > Please enter the SMTP port:

          The port number typically is 25, 465, or 587.

        • > Please enter the SMTP username:

          If authentication is required

        • > Please enter the SMTP password:

          If authentication is required.

        • > Does your SMTP server use SSL/TLS? (y/n)?
      • n: No SMTP server is set up; users cannot receive any related email notifications.
  10. The installation displays a summary of your choices and asks if you want to continue the installation.
    > Continue with installation? (y/n) [Default: y]:

    Verify that the information is correct and type y.

    The installation proceeds with installing and configuring:
    • Kubernetes cluster (K0S)
    • Docker Private Registry (DPR)
    • SQL Server instance
    • AppScan 360° central platform and components.
    • AppScan Remediation Advisories (ASRA)
    • Software Composition Analysis (SCA), if selected
    After a few minutes, the installation displays a completion message:
    The AS360 Single VM was installed, to access it do the following:
      1. Add to your 'hosts' file the following line: [IP_ADDRESS] [HOSTNAME].[DOMAIN]
      2. Access https://[HOSTNAME].[DOMAIN] in your browser
  11. Add the IP address and host name as provided to your host file.
    Operating system Host file location
    Linux, MacOS /etc/hosts
    Windows C:\Windows\System32\drivers\etc\hosts
    For example:
    192.168.1.100 appscan.appscan-test.local

Logging into and activating AppScan 360°

To login and activate AppScan 360°:
  1. Access the AppScan 360° interface using the specified URL (https://[HOSTNAME].[DOMAIN])
  2. Log in with the default credentials:
    • Username: Admin
    • Password: Admin12!
  3. Upload your AppScan 360° license file to activate the product.

Changing installation method

If, after installing and using the Express single VM installation of AppScan 360° you decide you want to install the production single VM version of AppScan 360° or AppScan 360° in distributed environment: