Home
Configuring
Learn how to configure the product.
Preferences
Preferences are personal choices about the appearance and operation of AppScan® Source for Analysis.
Enabling defect tracking with preferences
Defect Tracking System preferences allow you to enable the submission of findings to a defect tracking system - and determine how defects are submitted.
Rational Team Concert™ preferences
The Rational Team Concert™ preference tab allows you to configure a connection to a Rational Team Concert server and also to configure the values of work item attributes.
Rational Team Concert™ SSL certificates
When a Rational Team Concert™ server is installed, it should be configured to use a valid SSL certificate. If this is not done, you will receive an untrusted connection message when logging in to the server (while configuring preferences or submitting defects). This topic outlines Rational Team Concert SSL certificate considerations.

Configuring
Learn how to configure the product.
- Configuring applications and projects
  Before you scan, you must configure applications and projects. This section explains the Application Discovery Assistant, New Application Wizard, and the New Project Wizard. You will learn how to configure attributes for AppScan® Source for Analysis. In addition, this section teaches you how to add existing applications and projects for scanning - and how to add files to projects.
- Preferences
  Preferences are personal choices about the appearance and operation of AppScan® Source for Analysis.
  - General preferences
    General preferences allow you to tailor some of the AppScan® Source for Analysis default settings to fit your personal preferences.
  - AppScan® Enterprise Console preferences
    If your AppScan® Enterprise Server has been installed with the AppScan Enterprise Console option, you can publish assessments to it. The Enterprise Console offers a variety of tools for working with your assessments - such as reporting features, issue management, trend analysis, and dashboards.
  - Application server preferences for JavaServer Page compilation
    If you are scanning an application that contains JavaServer Pages (JSP), the AppScan® Source analysis engine must be able to compile the JSP code in order to analyze it. When you create your JSP project, you must specify the JSP compiler that AppScan Source should use (or accept the default compiler, which can be set in the Java™ and JSP preference page). If AppScan Source cannot compile your JSP files, use the application server preference pages to configure the JSP compiler that your application uses.
  - Defining variables
    When saving assessments or bundles, or publishing assessments, AppScan® Source for Analysis may suggest that you create a variable to replace absolute paths (without variables, AppScan Source for Analysis writes absolute paths to the assessment file to reference items such as source files). When you configure variables for absolute paths, you facilitate the sharing of assessments on multiple computers. It is recommended that you use variables when sharing assessments.
  - Enabling defect tracking with preferences
    Defect Tracking System preferences allow you to enable the submission of findings to a defect tracking system - and determine how defects are submitted.
    - Rational® ClearQuest® preferences
      To be able to complete Rational® ClearQuest® preferences, your Rational ClearQuest administrator must provide you with the required Rational ClearQuest settings. The settings are specific to your Rational ClearQuest environment.
    - Quality Center preferences
      You must first enable HP Quality Center as a General Defect Tracking System preference and then set the individual preference on the Quality Center tab.
    - Rational Team Concert™ preferences
      The Rational Team Concert™ preference tab allows you to configure a connection to a Rational Team Concert server and also to configure the values of work item attributes.
      - Rational Team Concert™ SSL certificates
        When a Rational Team Concert™ server is installed, it should be configured to use a valid SSL certificate. If this is not done, you will receive an untrusted connection message when logging in to the server (while configuring preferences or submitting defects). This topic outlines Rational Team Concert SSL certificate considerations.
      - Rational Team Concert™ server rename considerations when defect tracking from AppScan® Source for Analysis
        If you have enabled Rational Team Concert™ defect tracking in AppScan® Source for Analysis, and the Rational Team Concert server is renamed, any existing configuration for project areas on that server will no longer be available in AppScan Source for Analysis. You will need to connect to the server via its new repository URI and re-create the configuration in the Defect Tracking System preferences.
    - Team Foundation Server preferences
      The Team Foundation Server preference tab allows you to configure a connection to a Microsoft™ Team Foundation Server and to configure the values of work item fields.
  - Eclipse workspace importers: Eclipse or Rational® Application Developer for WebSphere® Software (RAD) preference configuration
    The AppScan® Source for Analysis installation provides a default Eclipse importer. This importer identifies the location of Eclipse and the JRE. If the default Eclipse importer is unable to import your workspace, it may be necessary to create a new Eclipse importer.
  - Email
    Configure email settings used to send findings under consideration as defects.
  - Java™ and JavaServer Pages
    Use this preference page to add, modify, or delete the Java™ Development Kit (JDK) that is used for scans (and to set a default JDK). In addition, use the page to set the default JavaServer Page (JSP) compiler.
  - Knowledgebase articles
    Use the Knowledgebase Articles preference page to set locations that contain AppScan® Source Security Knowledgebase articles.
  - Project file extensions
    Configure or add valid global file extensions for each project type, change the extensions to include in scans, exclude from scans, and specify extensions as web files.

Rational Team Concert™ SSL certificates

When a Rational Team Concert™ server is installed, it should be configured to use a valid SSL certificate. If this is not done, you will receive an untrusted connection message when logging in to the server (while configuring preferences or submitting defects). This topic outlines Rational Team Concert™ SSL certificate considerations.

SSL certificate storage location

Certificates that have been permanently accepted are stored in <user_home>/.jazzcerts (where <user_home> is your operating system home directory (for example, on Windows™, the directory might be C:\Documents and Settings\Administrator\)). Removing <user_home>/.jazzcerts deletes all stored certificates for AppScan® Source and Rational Team Concert™ clients.

SSL certificate sharing with Rational Team Concert™ clients

AppScan® Source shares its certificate store with Rational Team Concert™ clients. If you permanently accept a certificate using a Rational Team Concert™ client, it will be reused by AppScan® Source (you will not be prompted in AppScan® Source to accept a certificate). Similarly, if you permanently accept a certificate in AppScan® Source, it will be reused by Rational Team Concert™ clients.