/SCAFindingsToWorkItems

MIT LicenseMIT

SCAFindingsToWorkItems

Saves new Veracode SCA findings as Azure Devops Work Items.

Requirements:

  • Be using agent-based scan.
  • Output the results of the scan as a json: 'curl -sSL https://download.sourceclear.com/ci.sh | SRCCLR_CI_JSON=1 sh > sca_output.json'.
  • Have Azure Devops API Credentials able to read and write Work Items.
  • Add the credential's token as a secret variable called AZURE_API_CREDENTIALS

Parameters:

Mandatory:

  • json_file: name of the Json output file for the SCA scan
  • issue_type: the type of Work Item to be created
  • organization: the name of your Azure Devops organization (used to create the URL to call the api)
  • project_name: the name of your Azure Devops project (used to create the URL to call the api)

Optional:

  • Ticket_Title_Prefix: a prefix added to all Work Items created - defaults to 'Veracode SCA - '
  • Azure_Base_Directory: defines the azure server URL (include the full url up to the path - check default value for example). Used to set up the plugin on a self-hosted instance - defaults to 'https://dev.azure.com'
  • Overview_Name: Optional - allows for replacing the displayed value inside the created tickets for the Overview field - defaults to Overview
  • Vulnerability_Types_Name: Optional - allows for replacing the displayed title for the Vulnerability Types field - defaults to Vulnerability Types
  • Library_Source_Name: Optional - allows for replacing the displayed title for the Library Source field - defaults to Library Source
  • Vulnerable_Library_Name: Optional - allows for replacing the displayed title for the Vulnerable Library field - defaults to Vulnerable Library
  • Version_Range_Name: Optional - allows for replacing the displayed title for theVersion Range field - defaults to Version Range
  • Recommended_Version_Name: Optional - allows for replacing the displayed title for the Recommended Version field - defaults to Recommended Version
  • CVSS_Score_Name: Optional - allows for replacing the displayed title for the CVSS Score field - defaults to CVSS Score
  • CVE_Name: Optional - allows for replacing the displayed title for the CVE field - defaults to CVE
  • Veracode_Database_Link_Name: Optional - allows for replacing the displayed title for the Veracode Database Link field - defaults to Veracode Database Link
  • Calls_To_Method_Name: Optional - allows for replacing the displayed text for the Calls to Method field present on the vulnerable method calls breakdown - defaults to Method Calls to Method
  • At_Line_Name: Optional - allows for replacing the displayed text for the At Line field present on the vulnerable method calls breakdown - defaults to at line
  • Call_Name: Optional - allows for replacing the displayed text for the Call field present on the vulnerable method calls breakdown - defaults to Call
  • Calling_Name: Optional - allows for replacing the displayed text for the Calling field present on the vulnerable method calls breakdown - defaults to Calling
  • Vulnerable_Methods_Name: Optional - allows for replacing the displayed title for the Vulnerable Methods field - defaults to Vulnerable Methods
  • Starting_At_Name: Optional - allows for replacing the displayed text for the Starting at field present on the vulnerable method calls breakdown - defaults to Starting at

Usage:

  • Add the yml file to your project
  • Output the results of the agent-based SCA to a JSON file
  • Call the template yml file as below:
- template : SCAFindingsToWorkItems.yml  
  parameters:
    json_file: 'sca_output.json'
    issue_type: 'Issue'
    organization: 'ORGANIZATION NAME'
    project_name: 'PROJECT NAME'