Fortify SSC Plugin

This topic covers the Fortify SSC Plugin for Release.

The Release Fortify SSC enables Release to work with reports and metrics from a Fortify Software Security Center(SSC) server.

important

You must set up a connection to Fortify SSC server before adding Fortify tasks or tiles. For information, see Set up a Fortify SSC server.

note

In the release flow editor, Fortify SSC tasks have a red border.

Features

• Create a Fortify Check Compliance task.
• Add a Fortify SSC version summary tile to a release dashboard.
• Add a Fortify SSC application compliance tile to a release dashboard.

Requirements

The Fortify SSC plugin requires the following:

• Fortify SSC server running and accessible via HTTP(s).
• An application and version must be created. A FPR artifact uploaded and processed in the version.

Set up a connection to a Fortify SSC server

To set up a connection to a Fortify SSC server:

1. From the navigation pane, under Configuration, click Connections.
2. Under HTTP Server connections, next to Fortify SSC: Server, click .
3. In the Title field, enter a name for the configuration.
4. In the URL field, enter the address of the server.
5. If required, enter authentication details and proxy details.
6. To test the connection, click Test.
7. To save the configuration, click Save.

Add a Fortify Check Compliance task

The Fortify Check Compliance task creates a gate in the release flow, that fails if the Minimum Security Rating is not reached in the specified project name and version.

To add a Fortify Check Compliance task:

1. In the release flow tab of a Release template, add a task of type Fortify > Check Compliance.
2. Click the added task to open it.
3. In the Server field, select the configured Fortify server.

note

For information, see Set up a Fortify SSC server.

1. In the Project Name and Project Version fields, add the project and version you want to check for compliance.
2. In the Minimum Security Rating field, add the minimum rating that is required for the project to pass compliance. The Minimum Security Rating defaults to 5.

Add a Fortify SSC version summary tile to a release dashboard

The Fortify Summary tile type creates a dashboard tile that displays metrics on the selected project and version.

To add a Fortify SSC version summary tile to a release dashboard:

1. In the left navigation bar, click Dashboards.
2. Select the dashboard where you want to add the new tile.

note

If you have not created a dashboard yet, you can do so by clicking the Add dashboard button in the top right of the screen.

1. In the top right of the screen, click Configure dashboard.
2. In the top right of the screen, click Add tiles.
3. Hover over Fortify SSC version summary, and click Add.
4. On the dashboard, hover over the new Fortify SSC version summary tile, and click .
5. In the Title field, enter a name for the tile.
6. In the Server field, enter the name of the Fortify SSC server you want to connect with.
7. In the Project name field, enter the project that you want to display metrics on.
8. In the Application field, enter the application that you want to display metrics on.
9. In the Version field, enter the version that you want to display metrics on.
10. Click Save.

Add a Fortify SSC application compliance tile to a release dashboard

The Fortify Check Compliance task type creates a gate in the release flow, that fails if the Minimum Security Rating is not reached in the specified project name and version.

To add a Fortify SSC application compliance tile to a release dashboard:

1. In the left navigation bar, click Dashboards.
2. Select the dashboard where you want to add the new tile.

note

If you have not created a dashboard yet, you can do so by clicking the Add dashboard button in the top right of the screen.

1. In the top right of the screen, click Configure dashboard.
2. In the top right of the screen, click Add tiles.
3. Hover over Fortify SSC application compliance, and click Add.
4. On the dashboard, hover over the new Fortify SSC application compliance tile, and click .
5. In the Title field, enter a name for the tile.
6. In the Server field, enter the name of the Fortify SSC server that you want to connect with.
7. In the Time period field, select the period of time to display data on.
8. In the Application field, enter the application to display metrics on.
9. In the Security standards field, select the security standards to display.
10. In the Versions field, enter the versions to display metrics on.

note

Version filters follow semantic versioning. A custom regex can also be used, provided that it is python compatible.

1. Click Save.