Welcome
Interactive monitoring
Using an agent installed on your application, ASoC identifies security vulnerabilities in your application during runtime by monitoring all interactions, both legitimate and malicious. The process is "passive," in the sense that IAST does not send its own tests, and can therefore run indefinitely.
Deploying IAST
Deploy the IAST agent on the application server so it can monitor communication with the application and report to ASoC.
Deploy using the Key only option
Use this option to create an IAST session without downloading an agent. When selected, only a token is generated. This is useful when working with the IAST .NET Core Site Extension for Azure App Services, or when creating an IAST session for an already downloaded agent. This option applies to all IAST agents, across languages.

Getting started
Welcome to the documentation for HCL AppScan on Cloud, where you can find information about how to install, maintain, and use this service.
Navigation
This section describes navigating AppScan on Cloud, including items on the side main menu and top navigation bars, with links to more detailed information.
Management
Define users, roles, groups, applications, policies, and configure DevOps integrations.
Dynamic analysis
AppScan on Cloud performs security scans for web-applications for production, staging and development environments. For development environments it is aided by Private Site Scanning technology to scan applications not accessible to the open Internet.
Interactive monitoring
Using an agent installed on your application, ASoC identifies security vulnerabilities in your application during runtime by monitoring all interactions, both legitimate and malicious. The process is "passive," in the sense that IAST does not send its own tests, and can therefore run indefinitely.
- About interactive monitoring (IAST)
  ASoC can monitor normal application runtime behavior to detect vulnerabilities.
- Starting an IAST session
  Install the IAST agent on your application server, and configure the scan.
- Deploying IAST
  Deploy the IAST agent on the application server so it can monitor communication with the application and report to ASoC.
  - Deploy using the Key only option
    Use this option to create an IAST session without downloading an agent. When selected, only a token is generated. This is useful when working with the IAST .NET Core Site Extension for Azure App Services, or when creating an IAST session for an already downloaded agent. This option applies to all IAST agents, across languages.
  - Deploying a Java IAST agent
    This topic explains how to create a Java IAST agent type on your web server.
  - Deploying a .NET IAST agent
    This topic explains how to create a .NET IAST agent type on your web server.
  - Deploying a Node.js IAST agent
    This topic explains how to create a Node.js IAST agent on your web server.
  - Deploying a PHP IAST agent
    This topic explains how to create a PHP IAST agent type on your web server.
  - Deploying a Python IAST agent
    This topic explains how to deploy the Python IAST agent on your web server.
  - Deploy on Kubernetes
    AppScan supports automatic installation of the IAST agent on a Kubernetes cluster. Using a MutatingAdmissionWebhook, the IAST agent is automatically installed in any starting pod. You can install or remove the agent using Helm or Webhook scripts.
  - Deploy on Azure App Service
    Use the IAST agent to monitor applications that run on Azure App Service.
- OWASP Benchmark with IAST agent
- IAST using the REST API
  Configure and start an IAST scan, including agent deployment, through the REST API.
- IAST configuration file
  Configure a JSON file to override the default IAST settings, and report only the vulnerabilities you want to know about.
- User settings
  Some low-level IAST behavior can be controlled with user parameters.
- IAST scan results
  An interactive (IAST) scan entry shows results since the last time the scan was started.
- IAST troubleshooting
Software Composition Analysis
Use Software Composition Analysis (SCA) to scan for security vulnerabilities in open source and third-party packages used by your code.
Static analysis
Use static analysis (SAST) to scan for security vulnerabilities in web and desktop applications. Static analysis includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
AI-powered security
AppScan on Cloud recognizes the increasing role of artificial intelligence in development protocols. Just as AI can speed and strengthen the application development process, so can AI be used to ensure those applications are secure and ready for market.
Results
The Scans and Sessions page lists the scans under the categories DAST, SAST, SCA, and IAST, where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.The Scans and Sessions page lists scans under the categories where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.
Troubleshooting
If you experience problems with this service, you can perform these troubleshooting tasks to determine the corrective action to take.
FAQ & Reference
Frequently asked questions, information about integrating ASoC into the product lifecycle (SDLC), and ASoC API documentation.

Deploy using the Key only option

Use this option to create an IAST session without downloading an agent. When selected, only a token is generated. This is useful when working with the IAST .NET Core Site Extension for Azure App Services, or when creating an IAST session for an already downloaded agent. This option applies to all IAST agents, across languages.

Procedure

If you have not yet done so, create an application for your scans.
In the Application view, click Create scan to open the wizard, then select Interactive (IAST).
Select Key only from the drop-down menu.
Click Generate key. This generates a unique key that connects your application with the IAST session in ASoC. Save this key for later.
To collect IAST findings, set the following environment variables on the web server where IAST runs:
```
IAST_ACCESS_TOKEN: [key]
                        IAST_HOST: as shown in the instructions (e.g. https://cloud.appscan.com/IAST)
```
Note:
Setting these environment variables overrides any key and host information embedded in the agent. This allows the "Key only" session to be used with any agent you have already downloaded.