Scan a repository using an AppScan Presence

Before configuring the scan, set up an enabled AppScan Presence for your provider and ensure that you have access to the repository. For existing provider setup instructions, see GitHub, GitLab, Bitbucket, or Azure DevOps.

AppScan on Cloud supports one repository per scan. When triaging findings, you can view the relevant source code in the repository and filter findings by filename or path.

The repository server does not have to be publicly accessible. You must have network access to the server and permission to access its repositories.

1. Open the application, select Create scan, and then select Scan a repository under Scan from source control.
2. In Repository setup, select the source control provider: GitHub, GitLab, Bitbucket, or Azure DevOps. For GitHub, select GitHub Enterprise.
3. Select an enabled AppScan Presence for the provider, then select Authorize Presence and complete the authorization. If the connection fails, verify that the Presence agent is running and try again.
4. In the Repository section, select Repository list to choose a repository, or Repository URL to enter its full URL. Then select the Branch to scan.

   If a repository is not listed, verify that the connected account or app has read access to it. For GitLab token permissions, see Setting up an AppScan Presence to scan a GitLab repository.

5. Under Scan technology, select SAST, SCA, or both, according to your subscription. If your subscription provides only one technology, that technology is shown without a choice.

   When both are selected, SAST and SCA run as separate scans of the same repository and branch.

6. In Schedule, select one of the following:
   • Scan now: Run the scan after selecting Scan. If the concurrent scan limit is reached, the scan is queued until it can run.
   • Save for later: Save the configuration on the Scans and sessions page with the status Configuration saved. Saved configurations cannot be edited.
   • Schedule: Set the start date and time. For recurring scans, set the frequency and when rescans should stop.
7. In Scan options, enter the scan name and review the preferences. If both technologies are selected, enter a name for each scan.
   • Choose whether to run a personal scan. Its issues are not added to the application's issues.
   • Review your email notification settings.
   • Choose whether to allow intervention by the scan enablement team.
8. In Summary, review the repository, branch, scan names, and options. Go back to the relevant step to make changes.
9. Select Scan.