DOCSEARCHbyAlgolia
Submit Docs

Veracode Documentation

website·Indexed 42 days ago

https://docs.veracode.com/

Documentation for Veracode's application security platform, including the Dynamic Analysis API, Veracode Risk Manager (VRM), and Veracode Scan extensions for VS Code, Eclipse, and Visual Studio. It covers security scanning integrations for GitLab Self-Managed, Manual Penetration Testing (MPT) methodologies, and tools for container security and Software Composition Analysis (SCA).

Tokens
520.8K
Snippets
1.3K
Records
4K
Agent score
67%

What's inside Veracode

  1. Overview of Veracode Pipeline Scan

    Pipeline Scan embeds Veracode Static Analysis directly into development tools, IDEs, SCM repositories, and CI/CD pipelines. It allows developers to detect security findings in source code without connecting to the Veracode Platform. Because it is disconnected from the platform, it does not support flaw mitigations or flaw matching; for those features, use 'Upload and Scan'.

    The scan process involves:

    1. Uploading a packaged artifact to the Static Analysis Engine.
    2. Performing prescan verification.
    3. Executing Static Analysis to detect security findings.
    4. Comparing results against a baseline file to identify new findings.
    5. Assessing compliance against security policies.

  2. Overview of Veracode DAST Enterprise mode

    Veracode DAST Enterprise mode is an enhanced Dynamic Application Security Testing (DAST) solution used to identify vulnerabilities in web applications and APIs. It provides guidance for mitigating discovered vulnerabilities and preventing future attacks. Key enhancements over standard DAST include API specification management, expanded authentication options, and advanced configurations for both web and API scanning.

  3. Overview of Veracode Risk Manager (VRM)

    Veracode Risk Manager (VRM) is a platform designed to provide a comprehensive understanding of security risk across various tools. It allows users to manage security posture through several core features, including application and asset tracking, risk factor analysis, dashboard monitoring, issue management, and integration with Veracode Repository Scanning.

  4. Overview of Veracode GitHub Workflow Integration

    The Veracode GitHub Workflow Integration uses a GitHub app to automate security scanning for GitHub repositories. It supports three types of scans: Veracode Pipeline Scan (Static Analysis), Veracode SCA Agent-based Scan (SCA), and Infrastructure as Code (IaC) scans. The integration relies on a template repository containing required workflows and a veracode.yml configuration file for default settings.

  5. Overview of Veracode Fix for SCA

    Veracode Fix for SCA is an automated remediation solution that reduces the effort required to secure applications by analyzing vulnerable dependencies identified in Software Composition Analysis (SCA) findings. It runs a patch agent in a sandboxed backend environment to generate remediation patches that developers can review and apply to their source code. Because it uses AI-generated resolutions, all suggested patches should be carefully reviewed before application.

  6. Overview of Veracode Risk Manager (VRM) Connectors

    Veracode Risk Manager (VRM) uses connectors to ingest and unify security findings from development, cloud, infrastructure, and security tools. This integration allows users to identify the most urgent security issues and the riskiest assets across their environment.

  7. Overview of Veracode Fix GitHub Action

    The Veracode Fix GitHub Action integrates with the Veracode AI-assisted remediation service to generate code patches for flaws identified during a Veracode Pipeline Scan. It applies these patches to a new branch and creates a pull request for review, approval, and merging. The action uses either results.json (all flaws) or filtered_results.json (filtered flaws) from the Pipeline Scan to determine which fixes to generate.

  8. Overview of Veracode API Wrappers

    Veracode provides API wrappers for Java and C# that simplify the integration of Veracode XML APIs by wrapping complex XML calls into language-specific functions. These wrappers can be used as libraries within code or as command-line tools to automate projects within a Software Development Life Cycle (SDLC). They handle network connections, parameters, and interfaces automatically.

  9. Overview of Veracode Scan for VS Code

    Veracode Scan for VS Code is an IDE extension that integrates Pipeline Scan (for finding and reviewing code flaws), SCA Agent-based Scan (for open-source library vulnerabilities and license risk), and Veracode Fix (for applying suggested remediations) into the Software Development Lifecycle (SDLC). The extension automatically packages project code into artifacts (e.g., ZIP or JAR), uploads them to Veracode for analysis, and displays the results within the IDE.

  10. Overview of Veracode Risk Manager (VRM) Patterns

    Patterns in Veracode Risk Manager (VRM) allow administrators to automate actions on assets or issues when specific conditions are met. Patterns run on a daily schedule, reducing the need for manual intervention to maintain issue status, ticketing, applications, and labels.

    A pattern consists of three components:

    1. Conditions: Criteria built using VRM filters that assets or issues must meet. Multiple conditions can be evaluated together.
    2. Actions: The single operation performed on each matching entity (e.g., assigning labels, creating tickets, or updating issue status).
    3. Options: Configuration settings including the pattern name, description, status (Active/Deactivated), and the maximum number of entities affected per run.

  11. Overview of Veracode eLearning capabilities

    Veracode eLearning provides course-based training and a Knowledge Base on secure software development to help developers identify and address vulnerabilities. The platform includes training modules for developers, managers, and security personnel, allowing organizations to meet formal security training and competency testing requirements. Learners can track their progress via dashboards and usage-metric reports.

  12. Overview of General Security eLearning courses

    Veracode offers a variety of General Security training modules designed for different roles, including software developers, security professionals, and general employees. Available courses include:

    • Application Security Testing (35 min): Covers assessment preparation, baseline review, threat modeling, and reporting.
    • C/C++ Memory Management Risks and Best Practices (45 min): Focuses on stack/heap memory use and coding flaws in C/C++.
    • Introduction to PCI DSS for Developers (30 min): Explains Payment Card Industry Data Security Standards for secure credit card data environments.
    • Introduction to Web Application Security (40 min): Covers HTTP basics, application attacks, and exploit examples.
    • Secure Architecture and Design (40 min): Discusses functional security solutions, use/abuse cases, and data flow analysis.
    • Security Awareness (63 min): General training on workplace information security, social engineering, and password best practices.
    • Secure Software Remediation Basics (25 min): Overview of the software security remediation process from inception to execution.
    • Threat Modeling (25 min): Explains the purpose and application of threat modeling in development.
    • Cross Site Request Forgery (CSRF) Explained (20 min): Details how CSRF attacks work and how to detect and prevent them.