HCL AppScan RapidFix integration

HCL AppScan RapidFix is an AI-driven solution that automates the triage and remediation process for application security vulnerabilities. HCL AppScan RapidFix applies to SAST results.

AppScan offers native and advanced RapidFix capabilities to support your remediation workflows:

  • Native capabilities provide automatic triage and fix suggestions, including downloadable patches. They use AppScan-managed AI and require no additional server installation or AI provider configuration.
  • Advanced capabilities also support creating pull requests with fixes. They require an additional subscription and configuration.

RapidFix results are integrated into the ASoC interface for quick identification and action.

Enabling native RapidFix capabilities

You need permission to manage organization settings to enable native RapidFix and define its scope.

  1. Go to Settings and select AI powered features.
  2. In AI settings, select Enabled to enable AI capabilities for your organization.
  3. Under AI capabilities, enable RapidFix.
  4. Under Target scope, select one of the following:
    • All asset groups: Run RapidFix for applications in all asset groups.
    • Selected asset groups: Select one or more asset groups in Select asset groups to run RapidFix only for applications in those groups.
  5. Select Save in the RapidFix section.

After enabling RapidFix, run a SAST scan for an application in the selected scope.

Note:
Native RapidFix analyzes new SAST issues during scans run after it is enabled. Enabling RapidFix does not analyze results from earlier scans.

For assistance with RapidFix availability in your organization, contact your ASoC representative.

Acquiring and installing advanced RapidFix capabilities

Contact your ASoC representative for information about subscribing to advanced RapidFix capabilities.

Once subscribed, install Pixee Enterprise Server according to the instructions in Pixee Enterprise Server documentation.

Remediating results using HCL AppScan RapidFix

The RapidFix overview panel is available on the application's Issues page and on a SAST scan's Issues tab. The panel remains available for existing recommendations even if RapidFix is later disabled. If RapidFix is disabled and there are no recommendations, the panel is hidden.

For scans analyzed by RapidFix, results are indicated in the following ways:
  • On the scan's Issues tab, the RapidFix overview panel summarizes available recommendations. Set the toggle to Visible to display suggestions or Hidden to hide them.

    The panel contains All triage suggestions, RapidFix autofix, Close as noise, Increase severity, and Decrease severity counts. Select an available count to filter the issues grid by the related recommendations.

    While a scan or RapidFix analysis is in progress, counts may display --. Wait for processing to complete before reviewing the results.

  • The RapidFix icon () displays for a scan on the Scans and sessions page.

  • The RapidFix autofix and RapidFix triage columns on the Issues page are disabled by default. Enable them in the Columns list. You can use these columns even when the suggestion indicators are hidden.

    • RapidFix autofix indicates if an autofix is available for the issue.
    • RapidFix triage notes the results of AI analysis of the issue.
      Note:
      If you decide to ignore the triage suggested by RapidFix, this noted in issue audit trail as RFIgnoreTriage.
    Click the issue to open the Issue information pane to learn more.
  • A new tab – RapidFix – on the Issue information pane for the scan allows you to review the findings and take action.