Welcome
Configuring
Learn how to configure applications, folders, and projects, and set attributes and properties in HCL® AppScan® Source.
Configuring applications, folders, and projects
Before you scan, you must configure applications, folders, and projects. This section explains the Application Discovery Assistant, New Application Wizard, New Folder Wizard, and the New Project Wizard. You will learn how to configure attributes for AppScan® Source for Analysis. In addition, this section teaches you how to add existing applications and projects for scanning and how to add files to projects.
Creating a new project for an application
After you add an application, you add projects to it.
Adding an existing project
You can add AppScan® Source projects (.ppf files) previously created with AppScan Source for Analysis to AppScan Source applications. You can also add Eclipse project files (.epf), projects created by any of the supported build integration tools (for example, Ounce/Maven or Ounce/Ant), or project files created with Microsoft™ Visual C/C++ (.vcproj or.vcxproj), VB.NET (.vbproj), or C# (.csproj).

Welcome
Welcome to the documentation for HCL® AppScan® Source.
What's New
Explore new features added to AppScan® Source and note any features and capabilities deprecated in this release.
Installing
Learn how to install, upgrade, and activate HCL® AppScan® Source.
Configuring
Learn how to configure applications, folders, and projects, and set attributes and properties in HCL® AppScan® Source.
- Configuring applications, folders, and projects
  Before you scan, you must configure applications, folders, and projects. This section explains the Application Discovery Assistant, New Application Wizard, New Folder Wizard, and the New Project Wizard. You will learn how to configure attributes for AppScan® Source for Analysis. In addition, this section teaches you how to add existing applications and projects for scanning and how to add files to projects.
  - AppScan® Source application, folder, and project files
    AppScan® Source applications, folders, and projects have corresponding files that maintain configuration information required for scanning, as well as triage customization. These files should reside in the same directory as the source code, since configuration information (dependencies, compiler options, and so forth) required to build the projects is very similar to that required for AppScan Source to scan them successfully. Best practice includes managing these files with your source control system.
  - Configuring applications
    You can use the New Application Wizard or the Application Discovery Assistant to create applications. The Application Discovery Assistant automates application setup for you, whereas the New Application Wizard allows you to add applications, guiding you through the configuration process. The wizard helps you manually create a project or add existing projects to an application. This section describes these two methods for adding application and basic configuration tasks.
  - Configuring folders
  - Configuring your development environment for Eclipse projects
    Before you import an Eclipse project, you must properly configure the development environment. Although Eclipse is the basis for each project type, AppScan® Source distinguishes between the different versions.
  - Creating a new project for an application
    After you add an application, you add projects to it.
    - Choosing between source code and build output scanning
      When creating a new project, you have the option of choosing source code-only scanning or build output (bytecode) scanning, depending on the project.
    - Adding an existing project
      You can add AppScan® Source projects (.ppf files) previously created with AppScan Source for Analysis to AppScan Source applications. You can also add Eclipse project files (.epf), projects created by any of the supported build integration tools (for example, Ounce/Maven or Ounce/Ant), or project files created with Microsoft™ Visual C/C++ (.vcproj or.vcxproj), VB.NET (.vbproj), or C# (.csproj).
      - Adding an existing project with user interface actions
      - Adding an existing project with drag and drop
    - Adding multiple projects
      When you add multiple projects to an application, you can drag and drop them to the Explorer View, or you can browse a directory for projects and import some or all projects to the current application.
    - Adding a new Android Java project
      The New Project Wizard helps you manually create an Android Java project and add it to an application.
    - Adding a new Apex project
      The New Project Wizard helps you manually create an Apex project and add it to an application.
    - Adding a new ASP project
      The Project Configuration Wizard helps you manually create an ASP project and add it to an application.
    - Adding a new C/C++ project
      The New Project Wizard helps you manually create a C/C++ project and add it to an application. We strongly recommend direct import of Visual Studio solutions and projects, and subsequent import of makefile configurations using the Ounce/Make tool. While manual configuration is possible, it requires users to have significant and detailed knowledge of their compiler environment.
    - Adding a new C/C++/Objective-C source code-only project
      The New Project Wizard helps you manually create an C/C++/Objective C source code-only project and add it to an application.
    - Adding a new CSS project
      The New Project Wizard helps you manually create a CSS project and add it to an application.
    - Adding a new COBOL project
      The Project Configuration Wizard helps you manually create a COBOL project and add it to an application.
    - Adding a new ColdFusion project
      The Project Configuration Wizard helps you manually create a ColdFusion project and add it to an application.
    - Adding a new Dart project
      The New Project Wizard helps you manually create a Dart project and add it to an application.
    - Adding a new Django project
      The New Project Wizard helps you manually create a Django project and add it to an application.
    - Adding a new eSQL project
      The New Project Wizard helps you manually create an eSQL project and add it to an application.
    - Adding a new Go project
      The New Project Wizard helps you manually create a Go project and add it to an application.
    - Adding a new Groovy project
      The New Project Wizard helps you manually create a Groovy project and add it to an application.
    - Adding a new HTML project
      The New Project Wizard helps you manually create an HTML project and add it to an application.
    - Adding a new IBM RPG project
      The New Project Wizard helps you manually create a IBM RPG project and add it to an application.
    - Adding a new IaC project
      The New Project Wizard helps you manually create an Infrastructure as Code (IaC) project and add it to an application.
    - Adding a new Ionic project
      The New Project Wizard helps you manually create an Ionic project and add it to an application.
    - Adding a new Java™ or JavaServer Page (JSP) project
      When you add a new Java™ project to the application, you specify the project name, browse to the working directory, and then specify the source roots and project dependencies.
    - Adding a new or Java source code-only project
      The Project Configuration Wizard helps you manually create a Java source code-only project and add it to an application.
    - Adding a new JavaScript™ project
      The Project Configuration Wizard helps you manually create a JavaScript™ project and add it to an application.
    - Adding a new Kotlin project
      The New Project Wizard helps you manually create a Kotlin project and add it to an application.
    - Adding a new .NET source code-only project
      The New Project Wizard helps you manually create a .NET project and add it to an application.
    - Adding a new .NET Assembly project
      The New Project Wizard helps you create a .NET Assembly project. A .NET Assembly project can be used to scan compiled .NET assembly files, when source files may not be available or buildable. .NET Assembly projects consist of a working directory and list of sources, which may be directories or individual assembly files.
    - Adding a new pattern-based project
      The New Project Wizard helps you manually create a pattern-based project and add it to an application.
    - Adding a new Perl project
      The New Project Wizard helps you manually create a Perl project and add it to an application.
    - Adding a new PHP project
      When you add a new PHP: Hypertext Preprocessor (PHP) project to the application, you specify the project name, browse to the working directory, and then specify the source roots and project dependencies. The project dependencies can also be set in the Project Dependencies tab of the project properties after the project has been created.
    - Adding a new PL/SQL project
      The New Project Wizard helps you manually create a PL/SQL project and add it to an application.
    - Adding a new Python project
      The New Project Wizard helps you manually create a Python project and add it to an application.
    - Adding a new React Native project
      The New Project Wizard helps you manually create an React Native project and add it to an application.
    - Adding a new Ruby project
      The New Project Wizard helps you manually create a Ruby project and add it to an application.
    - Adding a new Rust project
      The New Project Wizard helps you manually create a Rust project and add it to an application.
    - Adding a new SAP ABAP project
      The New Project Wizard helps you manually create an SAP ABAP project and add it to an application.
    - Adding a new Scala project
      The New Project Wizard helps you manually create a Scala project and add it to an application.
    - Adding a new Secrets project
      The New Project Wizard helps you manually create a secrets-only project and add it to an application.
    - Adding a new Swift project
      The New Project Wizard helps you manually create a Swift project and add it to an application.
    - Adding a new T-SQL project
      The New Project Wizard helps you manually create a T-SQL project and add it to an application.
    - Adding a new Terraform project
      The New Project Wizard helps you manually create a Terraform project and add it to an application.
    - Adding a new TypeScript project
      The New Project Wizard helps you manually create a TypeScript project and add it to an application.
    - Adding a new Visual Basic project
      The New Project Wizard helps you manually create a Visual Basic project and add it to an application.
    - Adding a new Vue.js project
      The New Project Wizard helps you manually create an Vue.js project and add it to an application.
    - Adding a new Xamarin project
      The New Project Wizard helps you manually create an Xamarin project and add it to an application.
  - Copying projects
    AppScan® Source for Analysis allows you to copy all project types except .NET projects. Modifications to the project do not affect the duplicated project; after you copy a project, there is no connection between the original project and the copied project. When you copy an imported project, you create an AppScan Source project file (.ppf) with all configuration information.
  - Modifying application and project properties
    When you select an application or project in the Explorer view, the current properties appear in the Properties view, where you can make modifications.
  - Global attributes
    Global attributes must be defined before they can be associated with individual applications. Global attributes are defined in the Properties view by selecting All Applications in the Explorer view.
  - Application attributes
    Application attributes apply to the currently-selected application and depend on previously created global attributes.
  - Removing applications, folders, and projects
    You can remove applications and projects from AppScan® Source for Analysis if they are not registered.
  - Explorer view
    Use the Explorer view to view hierarchies of applications and folders in your projects, to start new projects, and to access tools for working with your projects.
- Preferences
  Preferences are personal choices about the appearance and operation of AppScan® Source for Analysis.
Administering
Learn how to administer user accounts and permissions, audit user activity, and manage integrations in HCL® AppScan® Source.
Scanning
This section explains how to scan your source code and manage assessments in HCL® AppScan® Source.
Triage and analysis
Grouping similar findings allows security analysts or IT auditors to segment and triage source code problems. This section explains how to triage AppScan® Source assessments and analyze results.
Reporting
Security analysts and risk managers can access reports of select findings or a series of audit reports that measure compliance with software security best practices and regulatory requirements. This section explains how to create reports of aggregate finding data.
Extending product function
Learn how to extend the product to meet specific development requirements.
Reference
Review reference information for HCL® AppScan® Source, including using utilities, plug-ins, and APIs.
Troubleshooting and support
Self-help information, resources, and tools to help you troubleshoot issues while using HCL® AppScan® Source.

Adding an existing project

You can add AppScan® Source projects (.ppf files) previously created with AppScan® Source for Analysis to AppScan® Source applications. You can also add Eclipse project files (.epf), projects created by any of the supported build integration tools (for example, Ounce/Maven or Ounce/Ant), or project files created with Microsoft™ Visual C/C++ (.vcproj or.vcxproj), VB.NET (.vbproj), or C# (.csproj).

This table lists the project file types that you can open and scan with AppScan® Source for Analysis:

Table 1. Project File Types to Open
Project file type	File extension
Microsoft™ Visual Studio C/C++	.vcproj, .`vcxproj`
Microsoft™ Visual Studio C#	.csproj
Microsoft™ Visual Studio Visual Basic	.vbproj
AppScan® Source project file	.ppf
Eclipse project file	.epf

Note: Ounce/Make is the recommended method to import makefile configurations. While manual configuration is possible, it requires significant and detailed knowledge of the compiler environment.

To learn how to add an existing project, see these topics:

Important: If you are working with an AppScan® Source project that has dependencies in a development environment, ensure that you build the project in the development environment before importing it. After importing the project, if you modify files in it, be sure to rebuild it in the development environment before scanning in AppScan® Source (if you do not do this, modifications made to files will be ignored by AppScan® Source).

Note: When you import an existing .NET project, you can specify additional assemblies to scan. Add these assemblies in the project's Properties view Additional Assemblies tab. When you add additional assemblies, you can combine .NET projects that build with assemblies (including third party assemblies) that do not build, in a single scan.

Note: You can also open or import .pbxproj files as AppScan® Source projects.

Note: You can also add WAR and EAR files by dragging and dropping them into the Explorer view. However, these are added as applications and not projects. For more information, see Adding an existing application with drag and drop.