> For the complete documentation index, see [llms.txt](https://docs.opsmx.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.opsmx.com/integrations/integrating-post-deploy-tools/dast.md). # DAST Dynamic Application Security Testing (DAST) is a security testing approach that evaluates running web applications by simulating real-world attacks. Unlike static code analysis, DAST analyzes applications during runtime to identify vulnerabilities that may be exploitable in a production environment. ### Usage of DAST in Delivery Shield * Automatically trigger security scans against deployed applications. * Identify runtime vulnerabilities before applications reach production. * View scan results and vulnerability details within the OpsMx platform. * Enforce security policies based on vulnerability severity and compliance requirements. * Incorporate security testing into CI/CD workflows to support DevSecOps practices. * Generate reports that help development and security teams prioritize and remediate vulnerabilities. ### To Manage DAST: 1. Navigate to **Setup** > **Integrations**. 2. In the **Post Deploy** panel, click **DAST**. The DAST integration page is displayed. 3. Click **+New Account**.
4. In the popup that appears, enter the values for the fields:
* **DAST Integration Type -** Select the specific type of DAST scan you wish to perform (e.g., Dast Scan, API Scan, Postman Collection). #### DAST Scan Integration Type: If DAST scan integration type is selected, the following fields will be displayed: * **Account Name (mandatory) -** Enter a name for this OpsMx DAST integration account. * **Service URL (mandatory)-** Enter the base URL of the target application or service that needs to be scanned. * **Scan Policy (mandatory)-** Select the predefined security scan policies (e.g.; Default Policy, Dev CICD, Pen Test) to apply during the scan.
* **Retries -**Specify the number of times the scanner should attempt to retry in case of a failure. * **Threshold -**Specify the acceptable threshold limit or score for the security scan results. * **Delay -**Set the delay duration (in seconds) between consecutive scan requests or retries. * **Account -**Specify the target application's associated account name, if applicable. * **Application -**Enter the specific name of the application that needs to be included for the security scan. * **Service -**Enter the name of the specific service or component within the application to be scanned. * **Exclude Urls**: Enter any specific URLs or endpoints that the scanner must avoid during its operation. * **Pentest GPT Scan**: Toggle this switch to enable or disable the AI-assisted Pentest GPT scanning capabilities. * **Authentication Mode -**Toggle this switch to enable authenticated scanning for applications that require a login. * **User Name**: Enter the valid username credential required to log into the target application. * **Password**: Enter the corresponding password credential required to log into the target application. * **Login Url**: Specify the exact URL of the authentication page where the scanner should perform the login. * **Username Field**: Enter the HTML field name, ID, or selector used for the username input on the application's login page. * **Password Field**: Enter the HTML field name, ID, or selector used for the password input on the application's login page. * **Login Indicator**: Enter a Regular Expression (Regex) pattern that appears on the screen to confirm a successful login (e.g., `\Qadmin\E`). * **Logout Indicator**: Enter a Regular Expression (Regex) pattern that appears on the screen to confirm the user is logged out or unauthenticated (e.g., `\QSign in\E`). * Select the **Teams** and the corresponding **Environments** from the dropdown for which you want the integration to be available. The integration will be available for the selected teams and environment only. {% hint style="info" %} You can select up to 5 teams for the integration to be displayed. {% endhint %} * An example is given below for reference:
* In the example above, * if **Team 1**, **Team 2**, and **Team 3** are selected, only applications associated with these teams can access the integration. Any applications belonging to other teams, such as **Team 4**, will not have access to this account. * Even if the user who created this account is also an admin for **Team 4**, the integration account remains restricted and is not available for **Team 4**. * Access to the account is strictly limited to the specified **Teams** and **Environments** selected during account creation. * **For Organization Admins:** * When an **Organization Admin** creates an account without selecting specific **Teams** and **Environments**, the account will be universally applicable, granting access to **all teams** and **all environments** by default. * **For Team Admins with Multiple Teams:** * If a **Team Admin** who manages multiple teams creates an account without specifying particular **Teams** and **Environments**, the account will only be accessible to the teams for which the logged-in user holds admin privileges. * Click **Save**. The tool is connected. #### API Scan Integration Type: If API scan integration type is selected, the following fields will be displayed: * **Account Name (mandatory)-** Enter a name for this OpsMx DAST integration account. * **OpenAPI spec URL (mandatory)-** Enter tthe direct URL to the OpenAPI or Swagger specification file that defines the structure of the API to be scanned. * **Authentication Type**: Select the method used to authenticate against the API (e.g., apiKey, http). * **For apiKey:** * **Apikey Name -** Specify the exact key name or header used to pass the API token (e.g., 'Authorization' or 'x-api-key'). * **Apikey -** Provide the actual API key, secret, or token string used for authentication. * **Apikey In -** Select where the API key should be injected during the HTTP request (e.g., header, Query or cookie). * **For http:** * **Scheme** - Select the scheme to be either basic authentication or bearer token authentication. * If selecting basic authentication, provide username and password to authenticate. * If selecting bearer authentication, provide the token to authenticate. * **Service Url (mandatory)**- Enter the base URL of the target application or API service that needs to be scanned. * **Scan Policy (mandatory)-** Select the predefined security scan policies (e.g.; Default Policy, Dev CICD, Pen Test) to apply during the scan.
* **Retries -**Specify the number of times the scanner should attempt to retry in case of a failure. * **Threshold -**Specify the acceptable threshold limit or score for the security scan results. * **Delay -**Set the delay duration (in seconds) between consecutive scan requests or retries. * **Application -**Enter the specific name of the application that needs to be included for the security scan. * **Service -**Enter the name of the specific service or component within the application to be scanned. * **Exclude Urls**: Enter any specific URLs or endpoints that the scanner must avoid during its operation. * **Pentest GPT Scan**: Toggle this switch to enable or disable the AI-assisted Pentest GPT scanning capabilities. * Select the **Teams** and the corresponding **Environments** from the dropdown for which you want the integration to be available. The integration will be available for the selected teams and environment only. {% hint style="info" %} You can select up to 5 teams for the integration to be displayed. {% endhint %} * An example is given below for reference:
* In the example above, * if **Team 1**, **Team 2**, and **Team 3** are selected, only applications associated with these teams can access the integration. Any applications belonging to other teams, such as **Team 4**, will not have access to this account. * Even if the user who created this account is also an admin for **Team 4**, the integration account remains restricted and is not available for **Team 4**. * Access to the account is strictly limited to the specified **Teams** and **Environments** selected during account creation. * **For Organization Admins:** * When an **Organization Admin** creates an account without selecting specific **Teams** and **Environments**, the account will be universally applicable, granting access to **all teams** and **all environments** by default. * **For Team Admins with Multiple Teams:** * If a **Team Admin** who manages multiple teams creates an account without specifying particular **Teams** and **Environments**, the account will only be accessible to the teams for which the logged-in user holds admin privileges. * Click **Save**. The tool is connected. #### Postman Collection Integration Type: If Postman Collection integration type is selected, the following fields will be displayed: * **Account Name (mandatory)-** Enter a name for this OpsMx DAST integration account. * **Postman Collection File (mandatory)-** Upload the JSON file containing the exported Postman Collection to be used for the security scan. * **Postman Collection Variables -** Enter any key-value pairs representing variables needed to successfully execute the requests within your Postman Collection (e.g., environment variables, dynamic tokens). * **Service Url (mandatory)**- Enter the base URL of the target application or API service that needs to be scanned. * **Scan Policy (mandatory)-** Select the predefined security scan policies (e.g.; Default Policy, Dev CICD, Pen Test) to apply during the scan.
* **Retries -**Specify the number of times the scanner should attempt to retry in case of a failure. * **Threshold -**Specify the acceptable threshold limit or score for the security scan results. * **Delay -**Set the delay duration (in seconds) between consecutive scan requests or retries. * **Application -**Enter the specific name of the application that needs to be included for the security scan. * **Service -**Enter the name of the specific service or component within the application to be scanned. * **Exclude Urls**: Enter any specific URLs or endpoints that the scanner must avoid during its operation. * **Pentest GPT Scan**: Toggle this switch to enable or disable the AI-assisted Pentest GPT scanning capabilities. * Select the **Teams** and the corresponding **Environments** from the dropdown for which you want the integration to be available. The integration will be available for the selected teams and environment only. {% hint style="info" %} You can select up to 5 teams for the integration to be displayed. {% endhint %} * An example is given below for reference:
* In the example above, * if **Team 1**, **Team 2**, and **Team 3** are selected, only applications associated with these teams can access the integration. Any applications belonging to other teams, such as **Team 4**, will not have access to this account. * Even if the user who created this account is also an admin for **Team 4**, the integration account remains restricted and is not available for **Team 4**. * Access to the account is strictly limited to the specified **Teams** and **Environments** selected during account creation. * **For Organization Admins:** * When an **Organization Admin** creates an account without selecting specific **Teams** and **Environments**, the account will be universally applicable, granting access to **all teams** and **all environments** by default. * **For Team Admins with Multiple Teams:** * If a **Team Admin** who manages multiple teams creates an account without specifying particular **Teams** and **Environments**, the account will only be accessible to the teams for which the logged-in user holds admin privileges. * Click **Save**. The tool is connected.