Home
Developing
Learn how to develop by using the product.
Triage and analysis
Grouping similar findings allows security analysts or IT auditors to segment and triage source code problems. This section explains how to triage AppScan® Source assessments and analyze results.
Triage with filters
AppScan® Source for Analysis reports on all potential security vulnerabilities and may produce many thousands of findings for a medium to large code base. When you scan, you may find that the findings list contains items that are not important to you. To remove certain findings from the Findings view, you can choose a predefined filter or you can create your own filter. A filter specifies the criteria that determine which findings to remove from view.
Applying filters
Filters can be applied before or after scanning. To apply filters after scanning, use the Filter Editor or another view that allows you to apply filters. To apply filters before scanning, set a global filter or filter using a scan configuration. When you apply filters before scanning, you cannot show unfiltered findings or remove the filter without scanning again.
Determining applied filters
To allow you to quickly determine how filters have been applied to the findings in an assessment, AppScan® Source provides a filter indicator.

Developing
Learn how to develop by using the product.
- Scanning source code and managing assessments
  This section explains how to scan your source code and manage assessments.
- Triage and analysis
  Grouping similar findings allows security analysts or IT auditors to segment and triage source code problems. This section explains how to triage AppScan® Source assessments and analyze results.
  - Displaying findings
    The Findings view, or any view with findings, displays a findings tree (a hierarchical grouping of assessment criteria) and a findings table for each scan. The item that is selected in the findings tree determines the findings that are presented in the table.
  - The AppScan® Source triage process
    The triage process includes manipulating findings through bundles, filters, and exclusions - and comparing assessment results.
  - Sample triage
    This example describes an AppScan® Source triage workflow used by a security analyst. Triage workflow may vary according to your business needs.
  - Triage with filters
    AppScan® Source for Analysis reports on all potential security vulnerabilities and may produce many thousands of findings for a medium to large code base. When you scan, you may find that the findings list contains items that are not important to you. To remove certain findings from the Findings view, you can choose a predefined filter or you can create your own filter. A filter specifies the criteria that determine which findings to remove from view.
    - Using AppScan® Source predefined filters
      AppScan® Source includes a set of predefined filters that can be selected for filtering scan results. This help topic describes these out-of-the-box filters.
    - Creating and managing filters
      AppScan® Source offers multiple methods for creating and using filters. The main view for filter creation, the Filter Editor view, provides a robust set of rules which can be manually set and then saved to a filter. The Filter Editor view also provides a mechanism for managing filters that you have created - allowing you to easily modify or remove them. Alternately, you can filter the findings table using views that offer graphical representations of the findings - and then save those filters in the Filter Editor view. When you create a filter, the other views update to reflect the filter properties.
    - Applying filters
      Filters can be applied before or after scanning. To apply filters after scanning, use the Filter Editor or another view that allows you to apply filters. To apply filters before scanning, set a global filter or filter using a scan configuration. When you apply filters before scanning, you cannot show unfiltered findings or remove the filter without scanning again.
      - Applying filters globally
        Filters that have already been created can be applied to all applications, individual applications, and to individual projects. Global filters are applied in the Properties view - where you can specify how you want the filters applied (a filter can be applied directly - or its inverse can be applied). For example, if you want to set a global filter for an application, select it in the Explorer view and then open its Properties view (using the View menu or by right-clicking the application and clicking Properties).
      - Determining applied filters
        To allow you to quickly determine how filters have been applied to the findings in an assessment, AppScan® Source provides a filter indicator.
  - Triage with exclusions
    After a scan, you may decide that some findings are irrelevant to your current work, and you do not want them visible in the findings table when you triage the scan results. These exclusions (or excluded findings) no longer appear in the Findings view and the assessment metrics update immediately with the changed results. Filter and bundle exclusions added to a configuration only take effect on subsequent scans.
  - Working with bundles
    Bundles (a grouping mechanism for findings) allow you to import a snapshot of findings from AppScan® Source for Analysis to AppScan Source for Development. Once findings are in bundles, you can use AppScan Source for Development to open the project that contains the bundle, import the bundle, or open a saved bundle file (file_name.ozbdl).
  - Working with static analysis fix groups
    Fix groups are a new approach to managing, triaging, and resolving issues found in static analysis scans. After running a static scan, AppScan® Source organizes issues into fix groups based on vulnerability type and the required remediation task.
  - Modifying findings
    Modified findings are findings that have changed vulnerability types, classifications, or severities - or that have annotations. The Modified Findings view displays these findings for the current application (the application that is active as a result of opening an assessment for it). In the My Assessments view (available only in AppScan® Source for Analysis), the Modified column indicates if a finding has changed in the current assessment.
  - Comparing findings
    Use the Diff Assessments action or the AppScanDelta utility to compare assessments. When two assessments are compared, the differences between the two are displayed in the Assessment Diff view or in an .ozasmt file. The results summarize new, fixed/missing, and common findings.
  - Custom findings
    To augment your analysis results, you can create custom findings. These are user-created findings that AppScan® Source for Analysis adds to the currently-open assessment or selected application. Custom findings impact assessment metrics and can be included in reports. Once created, a custom finding is automatically included in future scans of the application.
  - Resolving security issues and viewing remediation assistance
    AppScan® Source alerts you to security errors or common design flaws and assists in the resolution process. The AppScan Source Security Knowledgebase - and internal or external code editors - help with this process.
  - Supported annotations and attributes
    Some annotations or attributes that are used to decorate code are processed during scans. When a supported annotation or attribute is found in your code during a scan, the information is used to mark the decorated method as a tainted callback. A method marked as a tainted callback is treated as if all of its arguments have tainted data. This results in more findings with traces. Supported annotations and attributes are listed in this help topic.
- AppScan® Source trace
  With AppScan® Source trace, you can verify input validation and encoding that meets your software security policies. You can look at the findings that produce input/output traces and mark methods as validation and encoding routines, sources or sinks, callbacks, or taint propagators.
- AppScan® Source for Analysis and defect tracking
  AppScan® Source for Analysis integrates with defect tracking systemsIBM® Rational Team Concert™ to deliver confirmed software vulnerabilities directly to the developer desktop. Defect submission to a defect tracking system contains a textual description of the bug and a file that contains only the findings submitted with the defect.
- Findings reports and audit reports
  Security analysts and risk managers can access reports of select findings or a series of audit reports that measure compliance with software security best practices and regulatory requirements. This section explains how to create reports of aggregate finding data.
- Creating custom reports
  In the Report Editor, you create report templates used to generate custom reports.

Determining applied filters

To allow you to quickly determine how filters have been applied to the findings in an assessment, AppScan® Source provides a filter indicator.

In the AppScan® Source for Development (Eclipse plug-in), the filter indicator is located at the bottom of the main workbench.

If no filters have been applied, the filter indicator at the bottom of the workbench indicates that Findings are not filtered.

If filters have been applied, the indicator changes to a link that reads Findings are filtered. Selecting this link opens a message that allows you to determine how filters have been applied:

Scan-time filters are global filters that are applied to applications and projects. This filtering mechanism is only supported in AppScan® Source for Analysis. You will only find this type of filtering in the AppScan® Source for Development (Eclipse plug-in) if your Eclipse project was modified in AppScan® Source for Analysis to include filters - or if your assessment was created in AppScan® Source for Analysis:
- If the assessment is the result of scanning an application or project that does not have filters configured, the message indicates that no scan-time filters have been applied.
- If the application or project that was scanned does have filters configured, the configured filters are listed by name.
- In some cases, AppScan® Source detects that scan-time filters have been applied, however, the assessment contains no information about those filters. For example, this could happen when an old assessment is opened.
Current filters are filters that have been applied to the findings after scanning. The message indicates if no current filters have been applied - or if filters have been applied. If the latter, a reset link is available. When this link is selected, current filters are removed from the findings.

When you open an assessment, scan-time filters are listed by name in the assessment summary. Scan-time filters are global filters that are applied to applications and projects. This filtering mechanism is only supported in AppScan® Source for Analysis. You will only find this type of filtering in the AppScan® Source for Development (Visual Studio plug-in) if your solution was modified in AppScan® Source for Analysis to include filters - or if your assessment was created in AppScan® Source for Analysis.