This section describes new product features and enhancements in this release, as well as deprecations and anticipated changes, where relevant.

A summary of the minimum hardware and software required for the machine that runs AppScan Standard.

The installation wizard guides you through the fast and simple process.

This section describes license installation and management.

This topic explains the difference between the "stages" and "phases" of a scan.

This topic explains the different methods available for exploring sites, before AppScan tests them.

A diagram showing a simple AppScan workflow using the scan configuration wizard.

Describes the components of the AppScan main window, and all menus and toolbars.

Describes the options available from the Welcome Screen that opens when you load AppScan.

This simple tutorial goes through the steps of configuring a simple application scan using the Scan Configuration wizard, running the scan, and reviewing the results.

The sample scans can help give you a feel for using AppScan and what scan results look like.

You can quickly configure basic scans using the wizards.

Explains the basic structure of an AppScan Standard SCAN file.

A scan template is simply a scan configuration that has been saved so that you can use it again.

Manual exploring enables you to explore specific parts of your application, filling in fields and forms as you go. This can be a way of ensuring that particular areas of the site are covered, and that AppScan has the information needed to complete forms correctly.

You can use AppScan's External Traffic Recorder as a recording proxy, and manually explore RESTful or other non-SOAP web services - or SOAP services that do not require security envelopes - using a mobile phone, simulator, or emulator. AppScan displays the domains and requests in its External Traffic Recorder, and create appropriate tests from the input.

Generic Service Client (GSC) uses your web service's WSDL file to display a simple interface showing the services available, and lets you enter parameters and view the results. Use the GSC interface to explore your web service manually, so that AppScan can use your input to create appropriate tests.

AppScan offers three ways of viewing and working with scan results: Application Data, Security Issues, and Remediation Tasks. This section describes Application Data View.

AppScan offers three ways of viewing and working with scan results: Security Issues, Remediation Tasks, and Application Data. This section deals with Security Issues View.

AppScan offers three ways of viewing and working with scan results: Security Issues, Remediation Tasks, and Application Data. This section deals with Remediation Tasks view.

The Security report provides information about security issues discovered, and you can choose from a variety of templates depending on the type of content you need.

Industry Standards reports let you know if your application complies with standards of a selected industry committee; Regulatory Compliance reports let you know if your application complies with specific regulations or legal standards.

The Delta Analysis report compares two sets of scan results and shows the difference in URLs and/or security issues that were discovered in them.

The Template Based tab of the Create Report dialog box enables you to create reports in Microsoft® Word DOC and DOCX formats, with exactly the data you want, and the document formatting you define.

This section describes options you can control, to customize AppScan, from the Options dialog box (Tools > Options).

This extension lets you scan using Open API description files. It is available from Tools > Extensions > Web Services Wizard (Open API), and the extension is enabled by default.

AppScan offers access to five utilities (PowerTools), each providing a specific feature to help you manage your application security or to help you use AppScan.

Generic Service Client (GSC) provides a simple interface that displays the services available, and lets you input parameters and view the results. Use it to explore your SOAP web service manually, so that AppScan can use your input to create appropriate tests.

Logs can help you troubleshooting.

You can filter the Result List in any of the views, for specific data.

This section describes ways AppScan Standard and Enterprise editions can interact.

This section describes ways AppScan Standard can interact with HCL AppScan on Cloud, to scan apps on the cloud.

You can use scripts written for your QA automation framework (such as Selenium) to create Manual Explore recordings for an AppScan scan.

This workflow can help users with experience in the field of web security achieve a more thorough scan.

Sites in which all pages are reached using a single URL, need a specific scan configuration.

The following risks and suggestions should be considered before scanning a live site with AppScan.

This section describes how Test Optimization works and how best to incorporate it into your development lifecycle.

This topic addresses general application questions.

How to import the scan template from a scan saved in a version of AppScan earlier than 8.6.

Extended Support Mode logs all AppScan activity, for packing and sending to your support provider to help troubleshooting a problematic procedure.

You can configure AppScan to use a browser other than its built-in browser.

Tips for troubleshooting session detection problems in Scan Configuration > Login Management view.

For some types of site the Explore stage may take a long time or never end.

Some suggestions for troubleshooting action-based multi-step operations.

If you want to use an unsigned extension that you used with a previous version of AppScan, you can either elect to trust it, or see if a signed version is available to replace it with.

The following sections include explanations of Scan Log messages (View > Scan Log).

The following sections include explanations of AppScan® Log messages. (Help > AppScan Log)

The icons on the toolbar of the embedded AppScan® browser, used to display and save screenshots of application responses.

Used for creating, opening, and saving scans.

Used for customizing scan results.

Used to determine how the main window appears and what data is displayed.

Used to control the scan.

Provides various reporting and customization tools, including the HCL PowerTools.

Used for accessing documentation, getting support help, and getting a new license.

Describes all keyboard shortcuts and controls.

Describes where AppScan® saves its temporary files during normal operation, and how to change the location.

CWE (Common Weakness Enumeration) is an industry standard list that provides common names for publicly known software weaknesses. The following CWE IDs, and their parent or child IDs, are supported in the current version of AppScan Standard.

This glossary explains terms and acronyms used in the AppScan® Standard user interface and documentation.