Veracode Automation CLI (using Jenkins for SDL integration)

v0.5 (nov 2016)

Veracode Automation CLI

VERACODE AUTOMATION CLI

Why?

▸ Automate Application Security Scans

▸ Embed security scans in CI

▸ Based on Jenkins build pipeline

▸ Leverage central AppSec skills and distributed (one per app) network of Security Champions

VERACODE CLI


Veracode CLI

▸ Based on existing official REST API

▸ Hosted on GitHub, released under Apache 2.0 license

▸ https://github.com/DinisCruz/veracode-api

▸ Created to improve productivity and to allow easy creation of scan scripts

▸ Provides easy access to apps, scans, builds and results


List existing applications and builds


Current scan status


Create app, upload file, trigger scan, download, delete app

JENKINS INTEGRATION


Product Jenkins job triggers scan (on code push)


Simple configuration


Jenkins job to Download reports

▸ Runs every x minutes (at the moment set to 15m)


Downloads reports that are ready, deletes app


Results stored in GitHub (pushed from Jenkins)

CONCURRENT SCANS


Scans

Thanks

Veracode Automation CLI (using Jenkins for SDL integration)

Technology

Transcript of Veracode Automation CLI (using Jenkins for SDL integration)