Home
DAST
AppScan on Cloud performs security scans for web-applications for production, staging and development environments. For development environments it is aided by Private Site Scanning technology to scan applications not accessible to the open Internet.
Dynamic (DAST) scanning
ASoC can perform dynamic analysis of an application that runs in a browser or a web API. Use the configuration options available in ASoC, or upload an AppScan Standard configuration (template file) or a full scan file.
Using AppScan Standard

Welcome
Welcome to the documentation for HCL AppScan on Cloud.
Getting started
Security is about protecting your valuable assets. Some of the most important assets your organization owns are in the form of information, such as intellectual property, strategic plans, and customer data. Protecting this information is critical for your organization to continue to operate, be competitive, and meet regulatory requirements.
Navigation
This section describes the items on the main ASoC menu bar, and links to more detailed information.
Administration
Define users, applications, policies, and configure DevOps integrations.
DAST
AppScan on Cloud performs security scans for web-applications for production, staging and development environments. For development environments it is aided by Private Site Scanning technology to scan applications not accessible to the open Internet.
- Dynamic (DAST) scanning
  ASoC can perform dynamic analysis of an application that runs in a browser or a web API. Use the configuration options available in ASoC, or upload an AppScan Standard configuration (template file) or a full scan file.
  - Create scan
    Provide the Starting URL and user credentials for the scan, select the type of site, and (if not previously done) verify your permission to scan the site.
  - Create scan from template
    You can upload your own AppScan Standard template (SCANT) file to run an ASoC scan.
  - Create scan from scan file
    You can upload your own AppScan Standard scan (SCAN) file to run an ASoC scan.
  - Recording traffic
    You can download and install the free AppScan Activity Recorder browser extension (for Chrome or Edge), the AppScan Traffic Recorder extension, or use AppScan Standard.
  - Using AppScan Standard
  - Test policy
    The AppScan Standard Default test policy is used when running scans from the ASoC UI, but other policies can be applied with imported scans, or scans run from the API.
  - Test optimization
    Test Optimization uses intelligent test filtering to achieve faster scans, when speed is needed, with minimal loss of issue coverage. You choose between four optimization levels depending on your needs.
  - Test automation
    This section describes how to incorporate dynamic scanning in your functional testing.
  - Client certificates
- AppScan Presence
  An AppScan Presence on your server enables you to scan sites not accessible from the Internet, and to incorporate scanning as part of your functional testing.
- AppScan Traffic Recorder
  The AppScan Traffic Recorder (DAST proxy) enables you to record traffic to use as Explore data. Traffic Recorder instances can be created on demand to record traffic that will later be used for a DAST scan.
- Private sites
  An AppScan Presence on your server enables you to scan sites not accessible from the Internet.
IAST
Using an agent installed on your application, ASoC identifies security vulnerabilities in your app during runtime, by monitoring all interactions, both legitimate and malicious. The process is "passive", in the sense that IAST does not send its own tests, and can therefore run indefinitely.
Static analysis
Use static analysis (SAST) to scan for security vulnerabilities in web and desktop applications. Static analysis includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
Results
The Scan History tab of your application displays your scan results (including scan statistics) and rescan options.
Troubleshooting
If you experience problems with this service, you can perform these troubleshooting tasks to determine the corrective action to take.
FAQ & Reference
Frequently asked questions, information about integrating ASoC into the product lifecycle (SDLC), and ASoC API documentation.

Using AppScan Standard scans or templates

What is the benefit of using AppScan Standard?

If you have specific configuration requirements, you can configure and use your own AppScan Standard scan or scan template, and use it for your scan. A SCAN file is an actual AppScan scan with results; a SCANT file is an AppScan Standard configuration without results. You can use either as the basis of your ASoC scan. You can also record and validate the login procedure only, save as a LOGIN file, and upload to use in your ASoC scan.

Examples of specific cases where you might want to use a custom AppScan Standard SCAN, SCANT, or LOGIN file are:

The site has a complex login procedure that you want to record
You want to limit the scan to a specific part of the site
You want to configure some custom parameters
There are parts of the site that can only be reached by clicking links in a specific order

How to obtain AppScan Standard

Even without purchasing a license, you can use AppScan Standard to create configurations, upload configurations to run on ASoC, and download results to review.

If you have an active AppScan on Cloud subscription, you can download AppScan Standard from FlexNet Operations Portal (FNO):
Download the current version of AppScan Standard
If you only have a trial account for AppScan on Cloud, you can request a trial version of AppScan Standard to use during your trial period:
Request a free AppScan Standard trial version