Welcome
Configuring
Learn how to configure applications, folders, and projects, and set attributes and properties in HCL® AppScan® Source.
Preferences
Preferences are personal choices about the appearance and operation of AppScan® Source for Analysis.
Application server preferences for JavaServer Page compilation
If you are scanning an application that contains JavaServer Pages (JSP), the AppScan® Source analysis engine must be able to compile the JSP code in order to analyze it. When you create your JSP project, you must specify the JSP compiler that AppScan Source should use (or accept the default compiler, which can be set in the Java™ and JSP preference page). If AppScan Source cannot compile your JSP files, use the application server preference pages to configure the JSP compiler that your application uses.
Tomcat
This topic describes the preferences that you need to set for configuring AppScan® Source to reference an Apache Tomcat application server other than one that is supplied with AppScan Source.

Welcome
Welcome to the documentation for HCL® AppScan® Source.
What's New
Explore new features added to AppScan® Source and note any features and capabilities deprecated in this release.
Installing
Learn how to install, upgrade, and activate HCL® AppScan® Source.
Configuring
Learn how to configure applications, folders, and projects, and set attributes and properties in HCL® AppScan® Source.
- Configuring applications, folders, and projects
  Before you scan, you must configure applications, folders, and projects. This section explains the Application Discovery Assistant, New Application Wizard, New Folder Wizard, and the New Project Wizard. You will learn how to configure attributes for AppScan® Source for Analysis. In addition, this section teaches you how to add existing applications and projects for scanning and how to add files to projects.
- Preferences
  Preferences are personal choices about the appearance and operation of AppScan® Source for Analysis.
  - General preferences
    General preferences allow you to tailor some of the AppScan® Source for Analysis default settings to fit your personal preferences.
  - AppScan® Enterprise Console preferences
    If your AppScan® Enterprise Server has been installed with the AppScan Enterprise Console option, you can publish assessments to it. The Enterprise Console offers a variety of tools for working with your assessments, such as reporting features, issue management, trend analysis, and dashboards.
  - Application server preferences for JavaServer Page compilation
    If you are scanning an application that contains JavaServer Pages (JSP), the AppScan® Source analysis engine must be able to compile the JSP code in order to analyze it. When you create your JSP project, you must specify the JSP compiler that AppScan Source should use (or accept the default compiler, which can be set in the Java™ and JSP preference page). If AppScan Source cannot compile your JSP files, use the application server preference pages to configure the JSP compiler that your application uses.
    - Tomcat
      This topic describes the preferences that you need to set for configuring AppScan® Source to reference an Apache Tomcat application server other than one that is supplied with AppScan Source.
    - WebLogic 11 and 12
      This topic describes the preferences that you need to set for configuring AppScan® Source to reference an Oracle WebLogic Server.
    - WebSphere® Application Server
      This topic describes the preferences that you need to set for configuring AppScan® Source to referenceWebSphere® Application Server for JSP compilation.
  - Defining variables
    When saving assessments or bundles, or publishing assessments, AppScan® Source for Analysis may suggest that you create a variable to replace absolute paths (without variables, AppScan Source for Analysis writes absolute paths to the assessment file to reference items such as source files). When you configure variables for absolute paths, you facilitate the sharing of assessments on multiple computers. It is recommended that you use variables when sharing assessments.
  - Eclipse workspace importers: Eclipse preference configuration
    The AppScan® Source for Analysis installation provides a default Eclipse importer. This importer identifies the location of Eclipse and the JRE. If the default Eclipse importer is unable to import your workspace, it may be necessary to create a new Eclipse importer.
  - Java™ and JavaServer Pages
    Use this preference page to add, modify, or delete the Java™ Development Kit (JDK) that is used for scans (and to set a default JDK). In addition, use the page to set the default JavaServer Page (JSP) compiler.
  - Project file extensions
    Configure or add valid global file extensions for each project type, change the extensions to include in scans, exclude from scans, and specify extensions as web files.
Administering
Learn how to administer user accounts and permissions, audit user activity, and manage integrations in HCL® AppScan® Source.
Scanning
This section explains how to scan your source code and manage assessments in HCL® AppScan® Source.
Triage and analysis
Grouping similar findings allows security analysts or IT auditors to segment and triage source code problems. This section explains how to triage AppScan® Source assessments and analyze results.
Reporting
Security analysts and risk managers can access reports of select findings or a series of audit reports that measure compliance with software security best practices and regulatory requirements. This section explains how to create reports of aggregate finding data.
Extending product function
Learn how to extend the product to meet specific development requirements.
Reference
Review reference information for HCL® AppScan® Source, including using utilities, plug-ins, and APIs.
Troubleshooting and support
Self-help information, resources, and tools to help you troubleshoot issues while using HCL® AppScan® Source.

Tomcat

This topic describes the preferences that you need to set for configuring AppScan® Source to reference an Apache Tomcat application server other than one that is supplied with AppScan® Source.

Apache Tomcat version 9 is included in the installation of AppScan® Source. If you want to employ an external supported Tomcat compiler, use the Tomcat External preference pages to point to your local Tomcat installation. AppScan® Source compiles JSP files using the application server JSP compiler that is currently marked as default.

Specifying the installation home directory allows AppScan® Source to find all application server dependencies automatically when configuring projects. AppScan® Source compiles JSP files using the application server JSP compiler that is currently marked as default.

Tomcat External and JDK compatibility:


Tomcat version	Supported JDK
10.x	11 and later
11.x	17 and later