Welcome
Welcome to the documentation for HCL AppScan Standard version 10.3.0
Getting started
This section provides a short tour of basic product features and procedures, including using the wizard to set up a scan.
- Overview
- What's new
  This section describes new AppScan Standard product features and enhancements in this release, as well as deprecations and anticipated changes, where relevant.
- System requirements
  A summary of the minimum hardware and software required for the machine that runs AppScan Standard.
- Installing
  The installation wizard guides you through the fast and simple process.
- License
  This section describes for the trial and paid versions of AppScan Standard.
- How an automatic scan works
  This topic explains the difference between the "stages" and "phases" of a scan.
- Web application vs. web API
  This topic explains the different methods available for exploring sites, before AppScan tests them.
- Basic workflow
  A diagram showing a simple AppScan workflow using the scan configuration wizard.
- Home screen
  Describes the options available from the home screen that opens when you load AppScan.
- Tour of the main screens
  Describes the components of the AppScan main screen (Issues view), and all menus and toolbars.
- Tutorial
  This simple tutorial goes through the steps of configuring a simple application scan using the Scan Configuration wizard, running the scan, and reviewing the results.
- Sample files
  The sample files can help give you a feel for using AppScan and what scan results look like.
Configuration
You configure a scan by choosing settings that best describe your application, and the kind of testing you want.
Manual exploring
Manual exploring enables you to explore specific parts of your application, filling in fields and forms as you go. This can be a way of ensuring that particular areas of the site are covered, and that AppScan has the information needed to complete forms correctly.
Scanning
Learn how to start a scan, and what happens during the scan; how to manually manipulate the Explore stage, and how to export the results of a scan.
Data
Data view is populated with information about the structure of the site during the Explore stage of the scan.
Issues
Issues view provides access to the results of a scan. You can view results at a high level or select specific tests or objects and access more details. These details include how to fix, requests/responses, and differences between the test variants that resulted in issues. You can manipulate the severity of issues, resend tests (with or without modifications), and create reports based on Issues.
Reports
This section describes how to generate reports from the scan results.
Tools
This section explains how to use additional tools provided with HCL AppScan Standard.
Integrations
This section describes integrations of other applications with AppScan Standard:
Best practices
This section contains some best practices and use cases for advanced users.
FAQ & Troubleshooting
CLI
This section describes the syntax and options available using the Command line interface.
References
Menus and toolbar summaries, and glossary

What's new

This section describes new AppScan Standard product features and enhancements in this release, as well as deprecations and anticipated changes, where relevant.

New in HCL AppScan Standard 10.3.0

Third-party components are now identified and shown in the new Components tab in Data view, and related vulnerabilities are reported in Issues view.
CVSS vector links added to Issue information for all issues, including third-party components.
Support for password protecting scan files (File > Set password).
Test policy and optimization view has been improved.
Updated regulatory compliance report template: NIST Special Publication 800-53 Revision 5 (...\HCL\AppScan Standard\Policies).

Fixes and security updates

New security rules in this release include:

attAPIBrokenObjectLevelAuthorization - Check for Broken Object Level Authorization
attGraphqlSqli - Check for SQL Injections in GraphQL API
WeakJWTExpiration - Check if there is a JWT without an expiration date or with a late expiration date
WebSocketCSRF - Check if there is an authentication vulnerability in a WebSocket connection

For a complete list of fixes, new and updated security rules, and RFEs in this release, see AppScan Standard Fix List.

Changed in this release

The Incremental scan wizard is removed. Incremental scans are started from the File menu (File > New scan > Incremental)
The ability to start recording a multi-step operation by right-clicking on a node in the application tree (and selecting Record multi-step operation) is removed. Multi-step operations are now recorded only from Configuration > Multi-step operations).
The Web Services, The Vital Few, and Developer Essentials test policies have been removed from the Test Policies drop-down selection, as similar results can be obtained using other policies. They are still available in the Policies folder:
```
C:\Program Files (x86)\HCL\AppScan Standard\Policies
```

Upcoming changes

The following will be removed in a future release:

The embedded Internet Explorer browser will be removed in a future version of AppScan.
The Web Services, The Vital Few, and Developer Essentials test policies will be removed, as similar results can now be achieved using other policies (see here)
The ability to export scan results as XML for versions of AppScan Enterprise earlier than 9.0.3.1.