Welcome
Welcome to the documentation for HCL AppScan Standard version 10.4.0
Getting started
This section provides a short tour of basic product features and procedures, including using the wizard to set up a scan.
Configuration
You configure a scan by choosing settings that best describe your application, and the kind of testing you want.
Manual exploring
Manual exploring enables you to explore specific parts of your application, filling in fields and forms as you go. This can be a way of ensuring that particular areas of the site are covered, and that AppScan has the information needed to complete forms correctly.
Scanning
Learn how to start a scan, and what happens during the scan; how to manually manipulate the Explore stage, and how to export the results of a scan.
Data
Data view is populated with information about the structure of the site during the Explore stage of the scan.
Issues
Issues view provides access to the results of a scan. You can view results at a high level or select specific tests or objects and access more details. These details include how to fix, requests/responses, and differences between the test variants that resulted in issues. You can manipulate the severity of issues, resend tests (with or without modifications), and create reports based on Issues.
Reports
This section describes how to generate reports from the scan results.
Tools
This section explains how to use additional tools provided with HCL AppScan Standard.
Integrations
This section describes integrations of other applications with AppScan Standard:
Best practices
This section contains some best practices and use cases for advanced users.
- Workflow for advanced users
  This workflow can help users with experience in the field of web security achieve a more thorough scan.
  - Initial Configuration
  - Initial Automatic Explore
    After your basic configuration, you can run an initial Automatic Explore to see how well AppScan covers the site at this stage.
  - Improve site coverage manually
    You can add URLs that the initial Automatic Explore stage missed, both individual URLs (such as those accessed by forms that require specific input) and ordered sequences of URLs (such as shopping carts).
  - Evaluate Explore results
    Before proceeding to the Test stage, review the Explore results, because if important areas of the site were missed during the Explore stage, they will not be tested during the Test stage.
  - Additional configuration
    Here are some configuration changes to consider if site coverage in the initial Explore stage was insufficient.
- Sites that use parameter-based navigation
  Sites in which all pages are reached using a single URL, need a specific scan configuration.
- Scanning live production environments
  The following risks and suggestions should be considered before scanning a live site with AppScan.
- Understanding Test Optimization
  This section describes how Test Optimization works and how best to incorporate it into your development lifecycle.
FAQ & Troubleshooting
CLI
This section describes the syntax and options available using the Command line interface.
References
Menus and toolbar summaries, and glossary

Additional configuration

Here are some configuration changes to consider if site coverage in the initial Explore stage was insufficient.

About this task

If site coverage in the initial Explore stage was insufficient, or took more than about 30 minutes, consider making some or all of the following possible configuration changes to parameter and cookie definitions.

Procedure

Click Configuration > Parameters and Cookies view.
Tracking. If your site tracks cookies (such as session identifiers that are updated each time a user logs in), you should make sure they are correctly defined.
1. Verify that your site's cookies and parameters have been identified and are listed in the main Parameters and Cookies tab, and set as "Tracked".
2. If necessary, define additional parameters and cookies by clicking the icon. For more details see Parameter definition.
Redundancy Tuning. Careful redundancy tuning can significantly reduce scan time without any reduction in scan coverage and accuracy. Review the redundancy tuning to ensure that unnecessary duplicate requests are not sent, but necessary ones are. For more details, see Redundancy tuning.
1. If the cookie or parameter you want to configure is not listed in click the icon and define it.
2. Verify that settings are appropriate for each cookie or parameter.
Session ID verification. Accurate session ID definition is important to enable AppScan to create legitimate requests during the Explore stage.
1. Verify that the tracking setting for all session IDs are correctly defined as Login Value.
2. Verify that all parameters set as Login Value are session IDs.
If you made any changes to the Parameters and Cookies definitions, re-Explore the application. It may also be necessary to re-record the manual Explore and multi-step operations.