Home
Dynamic analysis
AppScan on Cloud performs security scans for web-applications for production, staging and development environments. For development environments it is aided by Private Site Scanning technology to scan applications not accessible to the open Internet.
AppScan Presence
An AppScan Presence on your server enables you to scan sites not accessible from the Internet, and to incorporate scanning as part of your functional testing.

Getting started
Welcome to the documentation for HCL AppScan on Cloud, where you can find information about how to install, maintain, and use this service.
Navigation
This section describes the items on the main AppScan on Cloud menu bar, with links to more detailed information.
Administration
Define users, applications, policies, and configure DevOps integrations.
Dynamic analysis
AppScan on Cloud performs security scans for web-applications for production, staging and development environments. For development environments it is aided by Private Site Scanning technology to scan applications not accessible to the open Internet.
- About dynamic analysis (DAST)
  An ASoC dynamic (DAST) scan consists of two stages: Explore and Test. Even though most of the scan process is seamless to the user, and no input is required until the scan is complete, understanding how dynamic scanning works can help you to better understand the role of scanning in your development process.
- Dynamic scanning (DAST)
  ASoC can perform dynamic analysis of an application that runs in a browser or a web API. Use the configuration options available in ASoC, or upload an AppScan Standard configuration (template file) or a full scan file.
- AppScan Presence
  An AppScan Presence on your server enables you to scan sites not accessible from the Internet, and to incorporate scanning as part of your functional testing.
  - System requirements
  - Creating the Presence
    For private web applications, or for including a scan as part of your functional testing procedure, you must create an AppScan Presence, with access to the web application or back-end server, and to the Internet. Proxy connections are supported.
  - Starting the Presence
  - Configuring Private Site Server proxy
    If your private network requires the Private Site Server to use a proxy to connect with the web application or back-end server (internal proxy), or with the Internet (outgoing proxy), configure it as follows.
  - Configuring a PAC file
    If a proxy auto-config (PAC) file is required in order to reach the various domains in your site, configure the AppScan Presence as follows.
  - Renewing the Presence key
    When you originally download the Presence, it includes a key to activate it. When that key expires, you must replace it with a valid key.
  - Log files
  - Upgrade to AppScan Presence V2
    AppScan Presence version 1 was deprecated in October 2022. If you have a V1 AppScan Presence installed, follow these instructions to upgrade to V2.
  - AppScan Presence troubleshooting
    Troubleshooting tasks for errors found when working with the AppScan Presence.
- Recording traffic
  You can record traffic as Explore data for DAST scans using the AppScan Activity Recorder browser extension (for Chrome or Edge), the HCL AppScan Traffic Recorder proxy server, or AppScan Standard.
- HCL AppScan Traffic Recorder
  The HCL AppScan Traffic Recorder (DAST proxy) enables you to record traffic to use as Explore data. Traffic Recorder instances can be created on demand to record traffic that will later be used for a DAST scan.
- IAST Total
  IAST Total (Interactive Application Security Testing), harnesses IAST capabilities to enhance Dynamic Analysis (DAST) scans, improving scan and remediation times while uncovering a broader spectrum of vulnerabilities.
- AppScan Standard
- Private sites
  An AppScan Presence on your server enables you to scan sites not accessible from the Internet.
Interactive monitoring
Using an agent installed on your application, ASoC identifies security vulnerabilities in your application during runtime by monitoring all interactions, both legitimate and malicious. The process is "passive," in the sense that IAST does not send its own tests, and can therefore run indefinitely.
Software Composition Analysis
Use Software Composition Analysis (SCA) to scan for security vulnerabilities in open source and third-party packages used by your code. SCA includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
Static analysis
Use static analysis (SAST) to scan for security vulnerabilities in web and desktop applications. Static analysis includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
Results
The Scans and Sessions page lists the scans under the categories DAST, SAST, SCA, and IAST, where you can view your scan results, including scan statistics. To view, rescan, or download reports, select a scan.
Troubleshooting
If you experience problems with this service, you can perform these troubleshooting tasks to determine the corrective action to take.
FAQ & Reference
Frequently asked questions, information about integrating ASoC into the product lifecycle (SDLC), and ASoC API documentation.

AppScan Presence

An AppScan Presence on your server enables you to scan sites not accessible from the Internet, and to incorporate scanning as part of your functional testing.

For web applications that are not accessible from the Internet you must create an AppScan Presence, with access to the web application or back-end server, and to the Internet, to be able to scan. Then follow the regular instructions for dynamic scanning. Proxy connections are supported.

Important: On March 13, 2022 a new version (V2) of the Presence was released. V2 offers improved stability and performance, as well as a log that lists all authorities (host:port) that the Presence accessed.

V2 does not include the AppScan DAST Proxy Server. This is now available as a separate download, called the HCL AppScan Traffic Recorder.
V1 is no longer supported (as of October 1, 2022).

If you have V1 installed, you should upgrade to V2. For details see Upgrade to AppScan Presence V2.

-

See also:

For scanning a private site that requires a client certificate, see:

Client certificates for private sites