How to do a DAST Scan
The Dynamic Application Security Testing (DAST) scan emphasis scanning of essential details such as the service URL and related configuration parameters that is collected from the ZAP integrator.
This page explains the process of integrating ZAP with SSD and perform the Adhoc DAST scan.
Before starting with the scan, you need to integrate ZAP with the OpsMx platform. Follow the steps provided in Integrating ZAP to complete the process.
If ZAP data needs to be mapped to a specific team, you need to create the team first. If no team-level segregation is required, skip this step. Follow the steps provided in Managing Teams to complete the process.
To Access Dast Scan
Click on Scan Now button at the top right corner of the screen.
In the screen that appears, select Dast Scan from the left panel.
Now you can Add Project, Upload Project or Sync Project to proceed with the scan.
To Add a Project
To add or update a new project with artifact scan configurations, click Add Project.
The Create Project details page is displayed as shown below. Enter the details for the following fields:
Name : Enter a name for the project.
Team : Select the team for which you want to create the project.
Scan Type : The default type is Dast Scan.
Platform : Select the platform type, ZAP.
Scan Type : The default scan type is Dast Scan.
Account : Choose the needed account that has been integrated for the selected platform. If no account is available for the selected platform then click Add Account.
The integration page is displayed. You can add a new account.
Service URL : Enter the URL link for which the scan needs to be done.
Scan Level : Select the scan level; either Web level or App level for which the scan needs to be applied.
Schedule Scan : You can set the scan schedule as to minutes or hours or days.
Click Save.
The project gets added for scanning.
Saving Configuration
After adding the configuration details you can click the Save Configuration option to save the adding details and trigger the scan at a later period.
The added project displays in the list with a Paused scan status.
When you want to scan the saved project you can click the Trigger Scan option to initiate the scan.
To Upload a Project
To upload a project from your local, click Upload Project.
Click Upload File and select the project you want to add for scanning.
Click Save.
The file gets added for scanning.
To Integrate JIRA at Project Level
JIRA can be integrated at project level to create tickets whenever an alert is identified.
To integrate JIRA, click the Integrations icon on expanding the project.
The JIRA integration page is displayed. Click Add Account and enter the details.
Enter the values for the following fields:
Account Name - Enter the JIRA account name.
Jira Project Key - Enter the name of your Jira project.
Jira URL - Enter your Jira host Url
Jira Email Id - Enter the username to access Jira.
Token - Enter the password / token for the Jira account.
Enable Automatically create Jira tickets during the scan to create JIRA ticket to the team owner when the alerts are identified.
Trigger Type - Indicates at which level Jira tickets should be created.
Create Jira ticket at the Component Alert level - Jira tickets will be created for each individual impacted component.
Create Jira ticket at the Deduplication Alert level - A single Jira ticket will be created for all the impacted components.
Creation Scope - If Vulnerabilities is selected, Jira is created only for Critical and High alerts. If All Policies is selected Jira is created for all alerts.
Enable Assign the Jira ticket to the Team owner if you want to assign the ticket to the team owner.
Fields - Enter the labels that need to be added in the created Jira ticket.
Values - Enter the values that need to be given in the Jira ticket. The given variables are replaced with actual values when the tickets are created.
Status Keyword Mapping - You can set the keywords for the status.
Click Test to check if the entered values are valid.
Once validated, click Save. The tool is connected.
To View AI-Based Remediation Details
AI Remediation is integrated in the Scan Now option.
Expand the project for which you want to view the remediation details.
Click Open Issues to view the list of alerts.
From the alerts list, select the required alert.
Navigate to the Impacted Components section and click on it.
In the list of applications, identify the relevant application and click Remediate.
The AI Remediation window is displayed. It analyzes the selected alert and provides a detailed summary of the issue, recommended remediation steps and possible workarounds.
AI Remediation is supported only for repositories hosted on GitHub Cloud. Remediation is performed only when the source details of the associated artifacts or projects are available.
To Sync Project
To View and Interpret Scan Results
Once the scan is complete, a confirmation message is updated within the project and OpsMx generates the overall results. They are displayed as shown below:
Repos Registered
Total Artifact Tags
Total Scans
Total Projects
Auto Scan Enabled Repos
The panel at the bottom displays the project details. On expanding each project you can view the complete details of it.
The current status of the scan (completed, pending or failed) is displayed to notify the status of the project.
To edit the configuration details of the project, click the Edit button.
Click the View option in the Action button, to view the SAST and SCA scan results of the project.
The results page displays the complete data of the scan details.
On clicking the Download button, the scan results are downloaded in .json or .csv format.
On clicking Report, the scan results are downloaded in a report format.
On clicking Go to Artifact Page, you are redirected to the related artifact page.
Quick Actions
Each project displays 5 quick action buttons as shown:
Trigger Scan – Initiates a new scan for the project or runs a scan using a previously saved configuration.
Integrations – Opens the project's Integrations page, where all available integrations for the project are listed.
Policies – Displays the list of policies that have been configured for the project.
Edit Project – Opens the project configuration settings, allowing you to modify the project's details and scan settings.
Delete – Removes the project from the system.
Last updated