Home
Developing
Learn how to develop by using the product.
AppScan® Source for Analysis and defect tracking
AppScan® Source for Analysis integrates with defect tracking systemsIBM® Rational Team Concert™ to deliver confirmed software vulnerabilities directly to the developer desktop. Defect submission to a defect tracking system contains a textual description of the bug and a file that contains only the findings submitted with the defect.
Integrating Microsoft™ Team Foundation Server and AppScan® Source for Analysis
The Team Foundation Server integration with AppScan® Source for Analysis requires a Microsoft™ Visual Studio Team Explorer client installation on the local computer.
Submitting defects to Microsoft™ Team Foundation Server
You can submit bundles with one or more findings to Team Foundation Server - or you can submit individual findings. The first time you submit a finding from AppScan® Source for Analysis to Team Foundation Server, you must log in with your username and password. If you want to configure the preset field values that will be used during submission, you can do so in the Team Foundation Server preferences.

Developing
Learn how to develop by using the product.
- Scanning source code and managing assessments
  This section explains how to scan your source code and manage assessments.
- Triage and analysis
  Grouping similar findings allows security analysts or IT auditors to segment and triage source code problems. This section explains how to triage AppScan® Source assessments and analyze results.
- AppScan® Source trace
  With AppScan® Source trace, you can verify input validation and encoding that meets your software security policies. You can look at the findings that produce input/output traces and mark methods as validation and encoding routines, sources or sinks, callbacks, or taint propagators.
- AppScan® Source for Analysis and defect tracking
  AppScan® Source for Analysis integrates with defect tracking systemsIBM® Rational Team Concert™ to deliver confirmed software vulnerabilities directly to the developer desktop. Defect submission to a defect tracking system contains a textual description of the bug and a file that contains only the findings submitted with the defect.
  - Enabling defect tracking with preferences
    Defect Tracking System preferences allow you to enable the submission of findings to a defect tracking system - and determine how defects are submitted.
  - Integrating HP Quality Center and AppScan® Source for Analysis
    The HP Quality Center integration with AppScan® Source for Analysis requires a Quality Center client installation on the local computer. The Quality Center client application is downloaded and installed on the local computer the first time you log in to Quality Center through the Quality Center browser-based client interface.
  - Integrating Rational® ClearQuest® and AppScan® Source for Analysis
    The Rational® ClearQuest® integration with AppScan® Source for Analysis requires a Rational ClearQuest client installation on the local computer. This installation includes the CQPerl executable, and you must configure the location of the executable in the AppScan Source for Analysis Rational ClearQuest preferences.
  - Integrating Rational Team Concert™ and AppScan® Source for Analysis
    Rational Team Concert™ integration with AppScan® Source for Analysis does not require that an additional Rational Team Concert client be installed on your computer.
  - Integrating Microsoft™ Team Foundation Server and AppScan® Source for Analysis
    The Team Foundation Server integration with AppScan® Source for Analysis requires a Microsoft™ Visual Studio Team Explorer client installation on the local computer.
    - Submitting defects to Microsoft™ Team Foundation Server
      You can submit bundles with one or more findings to Team Foundation Server - or you can submit individual findings. The first time you submit a finding from AppScan® Source for Analysis to Team Foundation Server, you must log in with your username and password. If you want to configure the preset field values that will be used during submission, you can do so in the Team Foundation Server preferences.
  - Working with submitted defects
    When you submit more than a few findings as separate defects, the process runs in the background while you continue the triage process. After the defect submission, a defect ID received from the defect system is attached to the relevant findings and remains with that finding. To work with a defect that has been submitted to your defect tracking system, follow the steps in this topic.
  - Submitting bundles to defect tracking and by email
    The findings in bundles can be submitted to your corporate defect tracking system - or sent by email. Once you place findings in a bundle, you can submit these findings as bugs for developer remediation.
  - Tracking defects through email (sending findings by email)
- Findings reports and audit reports
  Security analysts and risk managers can access reports of select findings or a series of audit reports that measure compliance with software security best practices and regulatory requirements. This section explains how to create reports of aggregate finding data.
- Creating custom reports
  In the Report Editor, you create report templates used to generate custom reports.

Submitting defects to Microsoft™ Team Foundation Server

You can submit bundles with one or more findings to Team Foundation Server - or you can submit individual findings. The first time you submit a finding from AppScan® Source for Analysis to Team Foundation Server, you must log in with your username and password. If you want to configure the preset field values that will be used during submission, you can do so in the Team Foundation Server preferences.

About this task

When you submit a bundle to Team Foundation Server, the work item number is associated with the specific findings in the bundle, rather than the bundle itself. This ensures that you can manipulate the bundle further while preserving the association of specific findings to work item numbers.

Note: When configuring the login to Team Foundation Server 2010, the Server URL must contain the Team Project Collection you want to connect to. For example, http://myserver:8080/tfs/DefaultCollection.

Procedure

Select the finding or findings in the table, or open the bundle. (If you open the bundle, select the bundle findings to submit.)
Right-click the selection and choose Submit Defect > Dispatch to Team Foundation Server from the menu.
The submission dialog box will then guide you through the process, including login, if necessary, and filling in required fields.

Results

A bundle will be automatically added to the submitted work item that can then be opened at a later time by a user of AppScan® Source for Analysis or AppScan® Source for Development.