# Source Scan

The Source Scan, scans both public and private repositories from the Git and Bitbucket. The scanning process includes SAST (Static Application Security Testing), code license verification, secret detection, and component analysis.

By integrating OpsMx Delivery Shield with your Bitbucket repository, you gain continuous, automated source code scanning that enhances the security of your software delivery pipeline. Regular scans, detailed reporting, and advanced features like CI/CD integration ensure that your software is built with security in mind from the very beginning.

This page explains the process of Source Scan for **Bitbucket** repository. 

* Before starting with the scan, you need to integrate Bitbucket with the OpsMx platform. Follow the steps provided in [Integrating BitBucket](https://docs.opsmx.com/opsmx-delivery-shield-platform/getting-started/integrating-ci-and-cd-tools-in-delivery-shield/bitbucket) to complete the process. 
* Once the Bitbucket integrator is connected to OpsMx you can start with the source scan. 

### To Access Source Scan 

* Click on **Scan Now** button at the top right corner of the screen.

<figure><img src="/files/KEeUIuLWTexDEX2JBuGV" alt=""><figcaption></figcaption></figure>

* In the screen that appears, select **Source Scan** from the left panel.

<figure><img src="/files/23G429FLA1YS0XuOpS1w" alt=""><figcaption></figcaption></figure>

Now you can **Add Project, Upload Project** or **Sync Project** to proceed with the scan.&#x20;

### To Add a Project&#x20;

* To add or update a new project with source scan configurations, for scanning, click **Add Project**.&#x20;
* The **Create Project** details page is displayed as shown below. Enter the details for the following fields:

<figure><img src="/files/KFmHHZ6f6D9xQMNaLd4R" alt=""><figcaption></figcaption></figure>

* **Name** : Enter a name for the project.&#x20;
* **Team** : Select the team for which you want to create the project.&#x20;
* **Scan Type** : The default type is Source Scan.&#x20;
* **Platform** : Select the platform type, the platform where the code resides (Github, Gitlab Server, Bitbucket, Bitbucket Server, Azure, Azure Server) for the project.
* **Account** : Choose the needed account that has been integrated for the selected platform. If no account is available for the selected platform then click **Add Account**.
  * The integration page is displayed. You can add a new account.&#x20;
* **Organization / Workspace** : Choose the organization or workspace that the selected account has access to.&#x20;
* **Scan Level** : Select the scan level; either organization level or repository level that needs to be scanned.&#x20;
* **Configuration** : Set the configuration details, and schedule the auto scan time.
  * Repo /Project : Select the repo or project name for which the scan needs to be executed.&#x20;
  * Branch :  Select the branch name for which the scan needs to be executed.&#x20;
  * Branch Pattern : Select the branch pattern for which the scan needs to be executed.&#x20;
  * Scan Upto : Select the branch limit for which the scan needs to be executed. (number of branches to be scanned)
  * Schedule Auto Scan :  Select the time range during which the scan needs to be rerun automatically.&#x20;
* Click Save.&#x20;

The project gets added for scanning.

### To Upload a Project

* To upload a project from your local, for scanning, click **Upload Project**.

<figure><img src="/files/HcMI4eAfLkeIYqbBlKVb" alt=""><figcaption></figcaption></figure>

* Click **Upload File** and select the json file that you want to add for scanning. &#x20;

<figure><img src="/files/IpQviTCNIyjgVQt5Iedm" alt=""><figcaption></figcaption></figure>

* Click **Save**.&#x20;

<figure><img src="/files/HDdpi87rWfnLEfu6M0bs" alt=""><figcaption></figcaption></figure>

The file gets added for scanning.

### To Integrate JIRA at Project Level

JIRA can be integrated at project level to create tickets whenever an alert is identified.&#x20;

* To integrate JIRA, click the Integrations icon on expanding the project.&#x20;

<figure><img src="/files/D87SrN8JKJlZ7rfSXbON" alt=""><figcaption></figcaption></figure>

* The JIRA integration page is displayed. Click **Add Account** and enter the details.&#x20;

<figure><img src="/files/zfsM6BarJXhWpjlfjjR2" alt=""><figcaption></figcaption></figure>

* Enter the values for the following fields:
  * **Account Name -** Enter the JIRA account name.&#x20;
  * **Jira Project Key -** Enter the name of your Jira project.&#x20;
  * **Jira** **URL -** Enter your Jira host Url&#x20;
  * **Jira Email Id -** Enter the username to access Jira.&#x20;
  * **Token -** Enter the password / token for the Jira account.&#x20;
  * Enable **Automatically create Jira tickets during the scan** to create JIRA ticket to the team owner when the alerts are identified.&#x20;
  * **Trigger Type** - Indicates at which level Jira tickets should be created.&#x20;
    * **Create Jira ticket at the Component Alert level** - Jira tickets will be created for each individual impacted component.&#x20;
    * **Create Jira ticket at the Deduplication Alert level** -  A single Jira ticket will be created for all the impacted components.&#x20;
    * **Creation Scope** - If Vulnerabilities is selected, Jira is created only for Critical and High alerts. If All Policies is selected Jira is created for all alerts.&#x20;
  * Enable **Assign the Jira ticket to the Team owner** if you want to assign the ticket to the team owner.&#x20;
  * **Fields -** Enter the labels that need to be added in the created Jira ticket.&#x20;
  * **Values -** Enter the values that need to be given in the Jira ticket. The given variables are replaced with actual values when the tickets are created.&#x20;
  * **Status Keyword Mapping** - You can set the keywords for the status.&#x20;
* Click **Test** to check if the entered values are valid.
* Once validated, click **Save**. The tool is connected.

### To View AI-Based Remediation Details

AI Remediation is integrated in the Scan Now option.&#x20;

1. Expand the project for which you want to view the remediation details.&#x20;
2. Click **Open Issues** to view the list of alerts.&#x20;

<figure><img src="/files/81Yfo5MHt22pqUQHq4oq" alt=""><figcaption></figcaption></figure>

3. From the alerts list, select the required alert.

<figure><img src="/files/CfxUuwD4p6lXBvtZD6Ze" alt=""><figcaption></figcaption></figure>

4. Navigate to the **Impacted Components** section and click on it.
5. In the list of applications, identify the relevant application and click **Remediate**.

<figure><img src="/files/WBeNueu8GkfIXl93QYVa" alt=""><figcaption></figcaption></figure>

The AI Remediation window is displayed. It analyzes the selected alert and provides a detailed summary of the issue, recommended remediation steps and possible workarounds.&#x20;

<figure><img src="/files/4CuuUFztzaA7F711TXEv" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
AI Remediation is supported only for repositories hosted on GitHub Cloud. Remediation is performed only when the source details of the associated artifacts or projects are available.
{% endhint %}

### To Sync Project

To Sync a project, for scanning, you can either sync it from Argo GitHub repository to SSD or add the project details in code format.&#x20;

#### Syncing Projects from Argo Github Repository

In a regular working instance of SSD with argo setup, create config map with name adhoc-project-cm and sync it with argo github repository. The YAML file name should be project.yaml.

The below example is a sample file that can be synced using argo. When synced this will create a config map with name adhoc-project-cm with project.yaml file containing one sample project

```
apiVersion: v1
kind: ConfigMap
metadata:
  name: adhoc-project-cm
data:
  project.yaml: |
    - name: bitbucket-ws1
      scanType: sourceScan
      platform: bitbucket
      accountName: bitbucket
      teamName: default
      scanLevel: repoLevel
      organisation: OpsMx
      type: organisation
      projectConfigs:
        - repository: docker-swarm
          scheduleTime: 0
          branch:
            - main
          branchPattern: ''
          scanUpto: 1
        - repository: issue-generator
          scheduleTime: 0
          branch:
            - fixes
            - grype
            - main
          branchPattern: ''
          scanUpto: 3
```

The following account names must be given by the user.

* Org level integrator account name: “dev”
* Team level integrator account name: "dev (\<team-name>)",&#x20;
* Env level integrator account name: "dev (\<team-name>) \[\<env-name>]",

```
kubectl apply -f project.yaml -n <namespace>
```

#### Syncing Projects in Code Format&#x20;

To Sync projects in code format add the project details int he given format below:

```
[
  {
    "name": "bitbucket-ws",
    "scanType": "sourceScan",
    "platform": "bitbucket",
    "accountName": "bitbucket",
    "teamName": "default",
    "scanLevel": "repoLevel",
    "organisation": "OpsMx",
    "type": "organisation",
    "projectConfigs": [
      {
        "repository": "docker-swarm",
        "scheduleTime": 0,
        "branch": [
          "main"
        ],
        "branchPattern": "",
        "scanUpto": 1
      },
      {
        "repository": "issue-generator",
        "scheduleTime": 0,
        "branch": [
          "fixes",
          "grype",
          "main"
        ],
        "branchPattern": "",
        "scanUpto": 3
      }
    ]
  }
]

```

### To View and Interpret Scan Results&#x20;

Once the scan is complete, OpsMx generates the overall results and they are displayed as shown below: <br>

* Repos Registered
* Total Branches
* Total Scans
* Total Projects
* Auto Scan Enabled Repos

<figure><img src="/files/5iT3oTn1kbuRTpTORhYh" alt=""><figcaption></figcaption></figure>

The panel at the bottom displays the project details. On expanding each project you can view the complete details of it.

{% hint style="info" %}
The current status of the scan (completed, pending or failed) is displayed to notify the status of the project.&#x20;
{% endhint %}

* To edit the configuration details of the project, click the **Edit Configuration** button.&#x20;
* Click the **View** option in the **Action** button, to view the SAST and SCA scan results of the project.&#x20;

<figure><img src="/files/Trxwxmlwnn0xW4wx9XCO" alt=""><figcaption></figcaption></figure>

* The results page displays the complete data of the scan details.&#x20;
  * On clicking the **Download** button, the scan results are downloaded in .json or .csv format.
  * On clicking Report, the scan results are downloaded in a report format.&#x20;
  * On clicking Go to Artifact Page, you are redirected to the related artifact page.&#x20;

<figure><img src="/files/xYGeD7FNoEyXFmUtpAQW" alt=""><figcaption></figcaption></figure>

### Best Practices

To get the most out of OpsMx Delivery Shield Source Scan, consider following these best practices:

* **Frequent Scanning**: Run the scans regularly (e.g., after each commit or weekly) to detect the vulnerabilities early.
* **CI/CD Pipeline Integration**: Incorporate source scanning into your continuous integration/continuous deployment pipeline to identify the issues before they go live.
* **Alerts and Notifications**: Set up alerts to notify your team when critical vulnerabilities are detected, to address them promptly.
* **Fixing Issues in Advance**: Address vulnerabilities as soon as they are found to prevent issues from piling up.

### Troubleshooting

If you encounter any issues during or after the scan, check the following:

* Connection Issues with Bitbucket:
  * Ensure that the correct authentication methods (OAuth, API tokens, SSH) are set up properly.
  * Verify that the OpsMx account has the necessary permissions to access the Bitbucket repository.
  * Check for bitbucket url whitelisting in supplychain api configmap

<br>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.opsmx.com/ssd/security-risk-and-prioritization/user-guide/scan-now/source-scan.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.