Home
Results
The Scan History tab of your application displays your scan results (including scan statistics) and rescan options.
Scan data

Welcome
Welcome to the documentation for HCL AppScan on Cloud.
Getting started
Security is about protecting your valuable assets. Some of the most important assets your organization owns are in the form of information, such as intellectual property, strategic plans, and customer data. Protecting this information is critical for your organization to continue to operate, be competitive, and meet regulatory requirements.
Navigation
This section describes the items on the main ASoC menu bar, and links to more detailed information.
Administration
Define users, applications, policies, and configure DevOps integrations.
DAST
AppScan on Cloud performs security scans for web-applications for production, staging and development environments. For development environments it is aided by Private Site Scanning technology to scan applications not accessible to the open Internet.
IAST
Using an agent installed on your application, ASoC identifies security vulnerabilities in your app during runtime, by monitoring all interactions, both legitimate and malicious. The process is "passive", in the sense that IAST does not send its own tests, and can therefore run indefinitely.
Static analysis
Use static analysis (SAST) to scan for security vulnerabilities in web and desktop applications. Static analysis includes Intelligent Finding Analytics (IFA) and Intelligent Code Analytics (ICA).
Results
The Scan History tab of your application displays your scan results (including scan statistics) and rescan options.
- Sample Security Reports
- Application reports
- Scan data
- Issues
  The Issues page for an application shows all issues found. You can apply a variety of filters to see the issues you need, and click on any issue to open the detailed issue information pane.
- Auto Issue Correlation
  AppScan analyzes issues found by IAST, DAST and SAST, to identify common weak links in the code - or "correlations" - that spot where multiple vulnerabilities can be resolved with a single or consolidated remediation effort.
- Fix Groups
  Fix Groups currently apply only to issues found in Static Analysis.
- Reports
  You can generate reports for issues discovered in an application, to send to developers, internal auditors, penetration testers, managers, and the CISO. Security information might be extensive, and can be filtered depending on your requirements.
- Triaging issues
  All issues are classified as new by default. You can see an issue classification by viewing the issue status.
- Issue status
  Issues can be classified as Open, In Progress, Noise, Reopened, Passed, and Fixed.
- Issue severity
  Issues can be classified as appear in the Issues grid of an app.
- Remediation
  After the risks are determined and the vulnerabilities are prioritized, your security team can start the remediation process.
- Rescanning
  Following your first scan, if you fix issues you can scan the same app again multiple times and overwrite the previous results, so the dashboard always displays the current results. When you scan again (rather than starting a new scan), the new scan overwrites the previous one.
- IAST scan results
  An Interactive (IAST) Scan entry shows results since the last time the scan was started.
Troubleshooting
If you experience problems with this service, you can perform these troubleshooting tasks to determine the corrective action to take.
FAQ & Reference
Frequently asked questions, information about integrating ASoC into the product lifecycle (SDLC), and ASoC API documentation.

Scan data

Scans view lists all scans in all your applications.

Partial scans

When a scan completes with results, but not all visited pages or discovered elements were tested, explored links or discovered elements were tested, it shows in the scan page as "Completed", but with a yellow icon.

When you open the entry for the scan, you see the message "Completed with partial results..."

The Partial scans filter (see image above), lets you focus on these scans.

All scans page options


Action	Description
Ask an expert	(Only when list is for all scans in an application:) Lets you schedule an online consultation with an AppScan expert.
Create scan	(Only when list is for all scans in an application:) Opens the scan creation wizard. See Scanning and monitoring
Filters	To filter the list of scans shown: Click one or both of the quick filter buttons, or Select one or more filters (check boxes) in the All filters drop-down list. Tip: When done, click All filters again to close the list. To remove all applied filters, click Clear filters.
	Click the twistie at the left of any scan row to view summary details of this scan (see the third scan entry in the figure above).
Scan name	(DAST only:) Click on the name to open the scan page, with full details of this scan. See Single scan view.
	This icon appears at the right end of scans that were run as personal scans. To promote, click and select Promote scan
	Click this icon at the end of any row to select these actions: Report (open scan report dialog) Promote (personal scans only) Rescan Download log Download scan Rename Delete The actions available vary according to context.