Custom installation of AppScan 360° on a single virtual machine

Custom mode is intended for full single-VM configuration and production-oriented deployments. This mode supports more deployment choices than express mode, including external database configuration, Docker registry selection, optional proxy settings, and OpenTelemetry integration.

Note: Run all installation and configuration steps as an administrator on the target system.

Before you begin

  1. Review Setting up the single VM environment and gather the values you will need during setup.
  2. Download all required kits from MyHCLSoftware portal into one directory. For example, /home/username/AppScan360_singleVM.

    Keep all installation kits in the same folder.

    Typical kit files:
    • AppScan360_SingleVMsetup_v<version>.run
    • AppScan360_v<version>.run
    • AppScan360_ASRA_v<version>.run
    • AppScan360_DTCS_v<version>.run (required for DAST template features)
    • AppScan360_SCA_v<version>.run (optional)
  3. Prepare the working directory and make the kits executable:
    mkdir -p ~/aio-setup
mv *.run ~/aio-setup/
cd ~/aio-setup
chmod +x *.run

Place Certificates (optional)

  1. If you use custom or self-signed certificates for LDAP, OIDC, SMTP, Docker registry, ingress, or OpenTelemetry collector trust, create the certificate folder structure first:
    sudo ./AppScan360_SingleVMsetup_v<version>.run -- "$PWD" prepareCertsFolders
    The command creates:
    Folder Function
    ~/aio-setup/certs/ Main certificates folder
    ~/aio-setup/certs/docker/ Docker Registry certificates
    ~/aio-setup/certs/ldap/ LDAP certificates (LDAPS)
    ~/aio-setup/certs/smtp/ SMTP certificates (SMTPS)
    ~/aio-setup/certs/oidc/ OIDC certificates (OIDCS)
    ~/aio-setup/certs/otel/ OpenTelemetry certificates when the collector uses a private CA
    ~/aio-setup/certs/ingress/ Ingress certificates (optional, self-signed will be generated if not provided)
  2. After folders are created, place certificate files in the appropriate paths before starting installation.

Run installation

  1. Start the installer:
    cd ~/aio-setup
sudo ./AppScan360_SingleVMsetup_v<version>.run -- "$PWD"

    If you need to stop and clean up an interrupted install:

    cd aioWorkspace
./disengageAS360-AIO.sh
    Installation log files are written to ./aioWorkspace/logs.
  2. When prompted, select Custom Mode (Production).
    Please select your installation path:
1. 🚀  Express Mode (POC)
2. 🛠️  Custom Mode (Production)
Enter 1 or 2 [Default: 1]:

Complete the custom questionnaire

The production flow asks a broader set of questions than Express mode.

SCA selection

Will this production deployment include Software Composition Analysis (SCA)? This requires license. (y/n) [Default: n]:

If you enable SCA, additional database and registry prompts are shown later in the flow.

Databse configuration

Choose the database type:

Please select the database type for this production deployment:
1. 🔷 Microsoft SQL Server (MSSQL)
2. 🐘 PostgreSQL
Enter 1 or 2 [Default: 1]:

Then provide database connection details:

> Enter Database Hostname or IP:
> Enter Database Port [Default: 1433]:
> Enter Database User for AppScan:
> Enter Database User Password:
> Enter the name for the main AppScan database [Default: AppScanCloudDB]:

If you select PostgreSQL, the default port is 5432.

SCA-specific configuration

If SCA is enabled, the installer also asks for:

> Please provide a name for the new SCA database [Default: AppScan360_SCA_DB]:
> Please provide a name for the new SCA Aggregation database [Default: AppScan360_SCA_Aggregation_DB]:
> SCA Registry Address [Default: hclcr.io]:
> SCA Registry Path [Default: appscan360/as360-k8s-docker-images]:
> SCA Helm Repository Path [Default: appscan360/as360-k8s-helm-packages]:
> SCA Registry Username (typically your HCL ID):
> SCA Registry Password/Token:

Use your HCL credentials if you want to enable SCA vulnerability database updates.

Network configuration

Primary domain:

Please enter the primary domain name for this installation. This will be used to create the access URL (for example, yourcompany.com):

External domains or IPs required for outbound access:

Provide the external domain(s) or IP address(es) this instance must access for external services (for example, SSO, SMTP). Use commas to separate multiple values. If none, press Enter to skip:

Local DNS connectivity:

Is this VM connected to a local DNS server? (y/n) [Default: n]:

OpenTelemetry endpoint:

Provide the OpenTelemetry collector endpoint URL. If not applicable, press Enter to skip (recommended format: http://<opentelemetry-collector-host>:4317):

Shared storage size:

To plan for long-term storage costs, estimate the number of scan results you plan to retain. > Specify the shared storage capacity in GB [Default: 200]:

SMTP Mail Relay (optional)

Do you want to configure an SMTP Mail Relay(SMR)? (y/n) [Default: n]:

If enabled, the installer asks for:

What is the SMR host?
What is the SMR port?
What is the SMR username?

Authentication mode:

Select SMTP authentication mode:
1. Password
2. Client Secret
Enter 1 or 2 [Default: 1]:

Then it asks for either the SMR password or SMR client secret, followed by:

Does the SMR operate over SSL/TLS. If yes, a certificate is required to be present in certs/smtp folder (y/n)?

Docker registry configuration

Custom mode supports either a kit-managed local Docker Private Registry or an external registry.

Choose whether the kit should install and manage DPR locally:

Do you want the kit to install and manage a local Docker Private Registry (DPR) on this VM? (y/n) [Default: n]:

If you choose n, the installer asks for external registry details:

What is the external Docker Private Registry (DPR) address (FQDN:PORT)?
What is the external Docker Private Registry (DPR) username?
What is the external Docker Private Registry (DPR) password?
What is the docker registry context/repository name [Default: as360-k8s-docker-images]:
What is the helm repository context/repository name [Default: as360-k8s-helm-packages]:

To use the registry root path instead of a context path, enter EMPTY for the context prompt.

If you choose y, the kit prepares a local DPR automatically.

Proxy service (optional)

Do you want to use a proxy service? (y/n) [Default: n]:

If enabled, the installer asks for:

What is the proxy host?
What is the proxy port?
Does the proxy require user/password credentials? (y/n):
What is the proxy username?:
What is the proxy password?:

Final confirmation

Before installation starts, the script displays a summary of your selections and asks for confirmation:

Continue with installation? (y/n) [Default: y]:

What the installer configures

After confirmation, the installer configures::
  • Kubernetes cluster (K0S)
  • AppScan 360° central platform (ASCP) and supporting components.
  • AppScan Remediation Advisories (ASRA)
  • Software Composition Analysis (SCA), if selected
  • External database connectivity
  • Docker registry connectivity

Installation time depends on system capacity and network performance.

At completion, the installer prints:
  • The hosts file entry to add
  • The final AppScan 360° access URL
Update your hosts file using the generated IP and hostname mapping.
Operating system Hosts file path
Linux, MacOS /etc/hosts
Windows C:\Windows\System32\drivers\etc\hosts
For example:
192.168.1.100 appscan.appscan-test.local

Log into and activate AppScan 360°

To login and activate AppScan 360°:
  1. Open the URL shown at install completion:: https://<host>.<domain>
  2. Sign in with the default credentials:
    • Username: Admin
    • Password: Admin12!
  3. Upload your AppScan 360° license file to activate the product.

Backup recommendation

Back up these items regularly:

  • Database
  • Configuration files in the installation directory
  • License information

Changing installation method

For distributed deployment, follow Distributed installation of AppScan 360°.

Common installation issues

Issue Solution
Database connection failures Verify database credentials and network connectivity
Insufficient disk space Ensure the VM has enough storage for your selected configuration
Certificate errors Verify certificate file formats, file names, and placement in the certs folders
Docker registry connectivity Verify registry credentials, address, and network connectivity
Any other issues Troubleshooting guide