Home
Managing application risk
Follow this workflow to manage application security risks in your organization.
Step 2: Testing applications for vulnerabilities
Learn how to test vulnerabilities identified in an application.
Scenarios for creating scans
These scenarios are targeted at developers and the security team. Choose the user role that most closely matches your situation.
Developers
The developer team creates scan templates using different methods and user interfaces in AppScan.
Creating an import scan
An import QuickScan uploads AppScan® files using parameters set in a scan template created by a Product Administrator. After the file is uploaded, its data is stored in a database for analysis by the reporting engine and made available to you through report packs, which are collections of reports.

Managing application risk
Follow this workflow to manage application security risks in your organization.
- Step 1: Creating an application inventory
  Learn how to create an application inventory.
- Step 2: Testing applications for vulnerabilities
  Learn how to test vulnerabilities identified in an application.
  - Importing issues from third-party scanners
    Learn how to import issues from 3rd-party scanners.
  - Scenarios for creating scans
    These scenarios are targeted at developers and the security team. Choose the user role that most closely matches your situation.
    - Overview of scan configuration differences in v9.0.2 and higher and in previous versions
      The security team (whose members have Administrator privileges) creates templates by using scan configuration that they author in AppScan Standard. The scan template file is then available for use in AppScan Enterprise. Developers (with QuickScan user privileges) pick up the template when they create a scan, and use a wizard in the new AppScan Dynamic Analysis Client to finish the scan creation. They use the same Client when they need to amend the scan configuration.
    - Developers
      The developer team creates scan templates using different methods and user interfaces in AppScan.
      - Creating a scan from a template
        Depending on the method your security team uses to create a scan template, you might use the AppScan Dynamic Analysis Client or the AppScan Enterprise user interface to create your scans. These topics describe each task you might need.
      - Editing a scan
        You can edit a basic scan to modify configuration options. If you need help editing your scan or you need more settings added to it, ask your security team to help you. They can edit your scan from an advanced view in the AppScan Dynamic Analysis Client.
      - Creating an import scan
        An import QuickScan uploads AppScan® files using parameters set in a scan template created by a Product Administrator. After the file is uploaded, its data is stored in a database for analysis by the reporting engine and made available to you through report packs, which are collections of reports.
    - Security Team
      Using scan configuration authored in AppScan standard, the security team creates templates.
    - Converting scan configurations from AppScan® Standard in the AppScan® Dynamic Analysis Client
      If you have an existing content scan that is based on a scan template (*.scant) from AppScan® Standard, you can convert the scan configuration so that you can edit it directly in the AppScan Dynamic Analysis Client. However, after you convert the scan configuration, you cannot open it again in AppScan Standard.
  - Running and scheduling jobs
    Learn how to run and schedule a job in AppScan Enterprise.
  - Copying a scan between two Enterprise Consoles
    Export scan properties and creating a new scan based on those properties. This is the method you use to copy a scan between two Enterprise Console instances.
  - Stopping a job and then resuming it
    There are three methods you can use to stop a job while it is running. Each method is used for a different reason, which largely depends on whether you want to keep the data or you want to continue running the job from the point where it left off. You can resume a suspended job to continue the scan from where it stopped. A resumed job is handled by the next free agent on any available agent server.
- Step 3: Determining risks and prioritizing vulnerabilities
  Learn how to determine risks and prioritize vulnerabilities identified in an application.
- Step 4: Remediating risks
  Learn how to remediate risks identified in an application.
- Step 5: Measuring progress and demonstrating compliance
  Learn how to measure progress and demonstrate compliance.

Creating an import scan

An import QuickScan uploads AppScan® files using parameters set in a scan template created by a Product Administrator. After the file is uploaded, its data is stored in a database for analysis by the reporting engine and made available to you through report packs, which are collections of reports.

Procedure

In the Scans view, select an import template from the template list and click the Create QuickScan icon.
(optional) Edit the scan name. (The name defaults to a unique version of the template name, but you can change it to something more meaningful.)
Click Browse to specify the file location. The file can be an XML file or a zipped XML file.
After you finish configuring your scan, save the scan options and start the scan. The Progress tab will open and display the scan statistics while the scan is running. You can also choose to:
- Save current results and stop: Saves the current results and stops the job. The run will finish normally and save the data collected so far in the database, but the reports will be incomplete.
- Discard results and stop: Discards any data collected during the run and stops the job.
Note: You can run or stop a scan from any of the three QuickScan tabs.

What to do next

When scan results are ready, you can view the reports on the Results tab. Reports display information about your website or application and provide the functionality to navigate to more details. Most of your data analysis tasks will focus on the data provided in these reports.