Welcome
Static analysis
Use static analysis (SAST) to scan for security vulnerabilities in web and desktop applications. Static analysis includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
Scanning for security vulnerabilities
To scan source code for security vulnerabilities, follow the steps in these topics.
Configuring a scan using AppScan Go!
AppScan Go! steps you through configuring and running a static scan. Run the scan in the service or use a plugin to automate scanning.
AppScan Go! Settings and Help menus

Getting started
Welcome to the documentation for HCL AppScan 360°, where you can find information about how to install, maintain, and use this service.
Installation
Learn about AppScan 360° architecture and how to install the product.
Navigation
This section describes the items on the main AppScan 360° menu bar, with links to more detailed information.
Administration
Define users, applications, policies, and configure DevOps integrations.
Dynamic analysis
HCL AppScan 360° performs security scans for web-applications for production, staging and development environments.
Interactive monitoring
Using an agent installed on your application, AppScan 360° identifies security vulnerabilities in your application during runtime by monitoring all interactions, both legitimate and malicious. The process is "passive," in the sense that IAST does not send its own tests, and can therefore run indefinitely.
Software Composition Analysis
Use Software Composition Analysis (SCA) to scan for security vulnerabilities in open source and third-party packages used by your code. SCA includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
Static analysis
Use static analysis (SAST) to scan for security vulnerabilities in web and desktop applications. Static analysis includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
- System requirements for static analysis
  Supported operating systems and the types of files, locations, and projects that can be scanned by AppScan 360° when you perform static analysis.
- Scanning for security vulnerabilities
  To scan source code for security vulnerabilities, follow the steps in these topics.
  - Configure a scan in AppScan 360°
  - Configuring a scan using AppScan Go!
    AppScan Go! steps you through configuring and running a static scan. Run the scan in the service or use a plugin to automate scanning.
    - AppScan Go! Settings and Help menus
  - Using the Static Analyzer Command Line Utility
    The Static Analyzer Command Line Utility (SAClientUtil) is used to generate an IRX that can be scanned in AppScan on Cloud or AppScan 360°. The appscan prepare command is supported for use with AppScan 360° Static Analysis.
  - About scanning using an archive file
  - Language-specific features
  - Static analysis scan results
    The SAST scanning engine uses AI and complementary technologies to improve detection accuracy and streamline result analysis.
- Static analysis troubleshooting
  If you experience problems with static analysis, you can perform these troubleshooting tasks to determine the corrective action to take.
Results
The Scans and Sessions page lists the scans under the categories DAST, SAST, SCA, and IAST, where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.The Scans and Sessions page lists scans under the categories where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.
Reference
Some frequently asked questions, and information about integrating AppScan 360° into the product lifecycle (SDLC).

AppScan Go! Settings and Help menus

From the AppScan Go! Settings menu, you can authenticate your user account on the AppScan service, check for available updates manually, and turn automatic updating off or on. AppScan 360° users also can allow untrusted connections. The Help menu gives information about AppScan Go! and links to additional information and HCL support resources.

Account information

To access account information, select Settings > Account.

If you are not currently logged in to AppScan 360°, first provide a key ID and key secret. AppScan Go! identifies and populates the Service URL field with the appropriate information.

If you are already logged in to AppScan 360°, the Account dialog box lists the current user, the user's organization, the key ID, and the URL of the AppScan service currently in use. To logout, or switch to a different user account, click Logout to log out of the currently connected AppScan service.

Check for updates

To access the Check for updates dialog box, select Settings > Check for updates.

The Check for updates dialog box lists the current versions of AppScan Go! and the Static Analysis client (SAClientUtil).

To check for available updates manually, click Check for updates.

When an update to AppScan Go! is detected, follow prompts to download and install the update.

Note: Automatic update of AppScan Go! does not work in AppScan 360°. See Automatic update of AppScan Go! fails for additional information.

Allow untrusted connections

AppScan 360° users have the option of allowing untrusted connections to their AppScan service.

To access the Allow untrusted connections dialog box, select Settings > Allow untrusted connections.

Untrusted connections are not allowed by default. Move the toggle button to allow or disallow untrusted connections with AppScan 360°.

Help menu

The Help menu provides additional information and resources for AppScan Go! users:

Select Help > About to access the About AppScan Go! dialog box.
Select Help > FAQ to access the FAQ dialog box.

Click on any of the questions to launch the online help in a new browser tab with information answering the question.
Select Help > Contact support to open the HCL Customer Support site in a new browser tab.