HCL TECHNOLOGIES ABOUT US PRODUCTS & SOLUTIONS RESOURCES CONTACT US

Home
Security AppScan Source - Windows and Linux
HCL® AppScan® Source delivers maximum value to every user in your organization who plays a role in software security. Whether a security analyst, quality assurance professional, developer, or executive, the AppScan Source products deliver the functionality, flexibility, and power you need - right to your desktop.
Extending product function
Learn how to extend the product.
Customizing the vulnerability database and pattern rules
This section describes how to customize the database and integrate customized vulnerabilities and other routines into scans.
Customizing with pattern-based rules
AppScan® Source pattern-based scanning is an analysis of your source code based on customized search criteria. Pattern-based scanning is similar to grep (grep searches one or more files for a given character string or pattern). Auditors or security analysts performing triage might use pattern-based scanning to search for specific patterns in specific applications or in a project. Once you define a pattern as a vulnerability type, a scan of your source code identifies the pattern as a vulnerability. When AppScan Source finds a match, the item appears in the findings table. The out-of-the-box AppScan Source rule library includes predefined rules and rule sets (collections of rules).
Pattern rule sets
A pattern rule set is a collection of pattern rules. You can add new pattern rule sets or you can modify or remove existing ones. AppScan® Source provides a series of language-specific pattern rule sets that you can choose to apply to your projects or applications (for example, you may want to apply the Java pattern rule set to your Java/JSP projects).
Creating a rule in the Pattern Rule Library rule
A pattern rule set is a collection of pattern rules. To learn how to create a rule set, follow the instructions in this topic.

Creating a rule set in the Pattern Rule Library view

A pattern rule set is a collection of pattern rules. To learn how to create a rule set, follow the instructions in this topic.

Before you begin

Note: You must have Manage Patterns permission to be able to create pattern rules or rule sets - or to modify and remove custom rules and rule sets.

Procedure

In the Pattern Rule Library view, click New Rule Set.
In the New Rule Set dialog box, enter a name for the rule set in the Name field.
Select one or more types of project that the rule set will apply to.
Click OK.
The new rule set appears in the rule set list. You can populate the rule set in one of two ways:
1. Select a rule or multiple rules in the pattern rule section and drag and drop them into the rule set.
2. Select a rule or multiple rules in the pattern rule section and then right-click the selection and select the Add to Rule Set menu item. In the Choose Rule Set dialog box, select the rule set that you want to add the rule or rules to.