Security is about protecting your valuable assets. Some of the most important assets your organization owns are in the form of information, such as intellectual property, strategic plans, and customer data. Protecting this information is critical for your organization to continue to operate, be competitive, and meet regulatory requirements.

HCL® AppScan® Enterprise enables organizations to mitigate application security risk, strengthen application security program management initiatives and achieve regulatory compliance. Security and development teams can collaborate, establish policies and scale testing throughout the application lifecycle. Enterprise dashboards classify and prioritize application assets based on business impact and identify high-risk areas, permitting you to maximize your remediation efforts. Performance metrics are provided that help you monitor the progress of your application security programs.

Depending on your role, you can get started with different areas of the product.

This section describes new AppScan Enterprise product features and enhancements in this release, as well as deprecations and anticipated changes, where relevant.

AppScan enhances application security by identifying and reporting vulnerabilities in third-party components, ensuring businesses are protected from potential threats. This helps prevent undetected vulnerabilities and ensures business continuity.

These are known issues and their workarounds.

If you are migrating from an earlier release of AppScan® Enterprise, you should be aware of the various features that have been deprecated in this release.

The configuration you use depends on a number of factors: what you plan to do with the software, how your organization and website or applications are structured, and how the information is to be distributed. Before you install the current release, review the information about hardware and software requirements, licensing, and other deployment considerations.

Before you install AppScan® Enterprise, you will need to prepare and configure your system.

This section provides the instructions for installing AppScan® Enterprise.

After you install AppScan® Enterprise, complete these postinstallation tasks.

Learn about changes that might affect your scans or report data when you upgrade from a previous version. Make sure that you read all the topics so that you understand the upgrade process.

Fix packs are available for download from FNO.

Beginning with v9.0.1, AppScan® Enterprise includes an architecture redesign to reduce the installation footprint and to remove Rational® Jazz™ Team Server (Jazz Team Server) as the user authentication component.

To migrate Jazz Team users to use the Liberty authentication method, export a .csv file of users by using a command before you begin upgrading to v9.0.1 and higher. Then, you can follow one of the following two methods and register the same users in Liberty so that they can access AppScan Enterprise v9.0.1 and higher.

For a successful upgrade to the latest version of AppScan Enterprise, read this topic carefully.

The AppScan® Enterprise Server configuration needs information about SQL Server. Configure the SQL Server first to save time during the AppScan configuration. If you upgrade SQL Server to a newer version, follow these instructions as well.

This procedure describes how to use Liberty certificates to secure IIS.

If you are changing LDAP settings (such as the server name or alias name) or if you are moving the AppScan® Enterprise Server to another computer, you must update the asc.properties file to reflect those changes.

Use one of these procedures to enable FIPS 140-2 or NIST SP800-131a on WebSphere Liberty Profile.

Learn how to integrate the product with QA automation systems.

Learn how to integrate the product with Defect Tracking Systems.

Learn about REST API in AppScan Enterprise.

Determine the technologies in use on your application that the content job will scan and refer to the following best practices for each type.

Performing a security scan in a production environment is risky; however, it might be necessary to scan a production environment, perhaps to comply with audit requirements, to detect whether your site has been hacked, or to validate that the SDLC process for integrating security scans is being employed.

The scan engine conducts over 1000 different tests and performs them multiple times.

This topic addresses general application questions.

There are several settings that you can personalize for your needs.

The Enterprise Console is the main user interface that supports administration, item configuration, and reporting.

The log files generated during a scan run are saved in the server for certain time frame. The time limit until when such log files are retained by the server is referred as log retention period. After this retention period, these log files become outdated while redundantly occupying memory space in the server. You can configure a time limit as a log retention period in the AppScan Enterprise, to automatically delete such log files after this preset period exceeds.

Learn how to manage user groups and access permission.

Administrators can configure the settings for log files for the Enterprise Console and AppScan Server and download them when they need to troubleshoot issues. This function eliminates the need to search the file system of the computer where the Enterprise Console or AppScan Server is installed.

The AdminUtil tool helps users to avoid rerun the configuration wizard on the AppScan Enterprise Server and the DAST Scanner(s) to reset the password. You can run the utility in two modes - Interactive mode and Silent mode. For more information about resetting service account password through interactive mode, see Resetting Service Account Password in AppScan Enterprise through the ASE AdminUtil tool in silent mode

The AppScan Enterprise (ASE) AdminUtil tool helps users to avoid rerun the configuration wizard on the AppScan Enterprise Server, IAST Communication service, DAST scanner(s), Database service, and Alert services to reset the password of service account. You can achieve this by running the utility in two modes - Interactive mode and Silent mode. For more information about resetting service account password through interactive mode, see Resetting Service Account Password in AppScan Enterprise through the ASE AdminUtil tool

Create an Activity Log report to determine who is using AppScan Enterprise and what they are doing with it. The report lists the users that made changes and when the changes were made. Because the log is always recording activity, all you must do is create the report. Only Administrators can create the Activity Log report; however, any user can be given access to it as part of a report pack's properties. If you do not want other users to see the Activity Log report, change `All Other Users' to No Access on the Users and Groups page for the report pack.

Activity Log helps determine who is using AppScan Enterprise and what they are doing with it. It lists the users that made changes and when the changes were made. This is useful for security auditing to detect possible unauthorized or unusual activities performed by users. Only Administrators can view the Activity log. By default, the activity log data is retained for one year.

Product Administrators are responsible for managing each server to its optimal performance.

See the status of scan jobs currently running or waiting to run so that you can prioritize the order in which your key scan jobs run. For example, you might have scan jobs that are part of a time-sensitive deliverable, like a holiday shopping special. You can move them to the top of the queue to make sure that they are prioritized first in the schedule.

The security rules are updated as a part of your AppScan® Enterprise releases. You can verify the version and release date of the security rules by looking in the About link in the AppScan Enterprise main menu.

AppScan® Standard provides a database of thousands of tests. However, if your web application has issues that are specific to it, or if you want to write your own advisories for fixing issues, you can create your own tests. These tests are saved and included in your AppScan database of tests. You can also export them as a *.udt file to import into AppScan Enterprise.

SQL Server database maintenance includes upgrading SQL servers, SQL database backup, log file configuration, and database usage.

Learn how to prepare for security testing in AppScan Enterprise.

Learn how to create scan templates in AppScan Enterprise.

Learn how to create an application inventory.

Learn how to test vulnerabilities identified in an application.

Learn how to determine risks and prioritize vulnerabilities identified in an application.

Learn how to remediate risks identified in an application.

Learn how to measure progress and demonstrate compliance.

Troubleshooting is a systematic approach to solving a problem. The goal of troubleshooting is to determine why something does not work as expected and explain how to resolve the problem.

HCL® Support provides assistance with product defects, answers FAQs, and helps users resolve problems with the product.

Learn how to troubleshoot the Dynamic Analysis scanner.

Learn how to troubleshoot the Enterprise Server.

These messages explain serviceability codes for: internal product messages, scan log messages, and web Services messages

Learn about configuring wizard topics.

Learn about folder explorer topics.

Reports are automatically generated after a job has run. They provide a way of managing issues so that you can helps you manage issues that are important to your organization and do so in a way that is supported both by the Enterprise Console's workflow and the workflows of other processes within your organization.

A GitHub collection of integrations, helper scripts, utilities, useful examples, libraries, and other resources related to HCL AppScan.