• Public

Integrations Group

Skip Feed
  1. Pinned Post

    Tim J (Veracode PM) (Veracode)

    May 2, 2019 at 5:55 PM

    Hi all, just a note that there are many customer and community authored integrations, scripts, code samples and more available on the Veracode Community Projects list on Veracode's Github page.

     

    On this list, you'll find sample integrations with a large number of different developer tools, including Bamboo, CircleCI, Slack, ConcourseCI, Travis, Gradle, PowerShell, sbt, and many others, and convenience scripts for working with results, mitigations and other common Veracode platform tasks.

     

    These scripts are shared with the community as-is and are not supported by Veracode, but you may find tools there that will help you with what you need to do! Likewise, if you've written a tool or script that you think might help other Veracode customers, let me know here or on Github and we will be happy to add it to the list!

    Expand Post

  1. Blomgren (Community Member) asked a question.

    November 30, 2022 at 9:48 PM
    Is there an integration to port Veracode DAST results into Archer eGRC?

    I found this page: https://community.veracode.com/s/knowledgeitem/rsa-archer-grc-MCB64QGFXOJZEQJGA7O4GVBMZK6E

    Its unclear to me what steps are involved to set this up

    The link to documentation goes to Archer's website but the post says that Veracode manages/supports the integration. That page also seems to be a dead end. Also, its not listed under the second link - Supported Versions... Please advise, its confusing to me.

    • 4 answers
    • 333 views
    Blomgren likes this.
    1 of 4

    • Blomgren (Community Member)

      Can anyone answer this question?

  2. Nishisharma1809 (Community Member) asked a question.

    December 1, 2021 at 10:31 AM
    Need help with veracode static scan display in Jenkins.

    Hi All,

     

    i am getting error in jenkins when i try to see the static scan results in jenkins:

     

     

     

    Ran into problem when generating scan results in Jenkins. Error: [ConnectException, Connection timed out (Connection timed out)]

    java.net.ConnectException: Connection timed out (Connection timed out)

    at java.net.PlainSocketImpl.socketConnect(Native Method)

    at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)

    at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)

    at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)

    at java.net.Socket.connect(Socket.java:607)

    at sun.net.NetworkClient.doConnect(NetworkClient.java:175)

    at sun.net.www.http.HttpClient.openServer(HttpClient.java:463)

    at sun.net.www.http.HttpClient$1.run(HttpClient.java:515)

    at sun.net.www.http.HttpClient$1.run(HttpClient.java:513)

    at java.security.AccessController.doPrivileged(Native Method)

    at sun.net.www.http.HttpClient.privilegedOpenServer(HttpClient.java:512)

    at sun.net.www.http.HttpClient.openServer(HttpClient.java:553)

    at sun.net.www.protocol.https.HttpsClient.<init>(HttpsClient.java:264)

    at sun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:367)

    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:203)

    at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1205)

    at sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1056)

    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:189)

    at sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(HttpURLConnection.java:1340)

    at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1315)

    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:264)

    at com.veracode.http.WebRequestHandlerImpl.makeFormUrlEncodedPostRequest(WebRequestHandlerImpl.java:33)

    at com.veracode.http.WebClient.makeRequest(WebClient.java:118)

    at com.veracode.http.WebClient.downloadString(WebClient.java:56)

    at com.veracode.apiwrapper.wrappers.UploadAPIWrapper.getAppList(UploadAPIWrapper.java:1117)

    at com.veracode.apiwrapper.wrappers.UploadAPIWrapper.getAppList(UploadAPIWrapper.java:1082)

    at com.veracode.jenkins.plugin.utils.WrapperUtil.getBuildInfo(WrapperUtil.java:78)

    at com.veracode.jenkins.plugin.VeracodePipelineRecorder.getScanResults(VeracodePipelineRecorder.java:749)

    at com.veracode.jenkins.plugin.VeracodePipelineRecorder.runScanFromRemote(VeracodePipelineRecorder.java:694)

    at com.veracode.jenkins.plugin.VeracodePipelineRecorder.perform(VeracodePipelineRecorder.java:315)

    at org.jenkinsci.plugins.workflow.steps.CoreStep$Execution.run(CoreStep.java:80)

    at org.jenkinsci.plugins.workflow.steps.CoreStep$Execution.run(CoreStep.java:67)

    at org.jenkinsci.plugins.workflow.steps.SynchronousNonBlockingStepExecution.lambda$start$0(SynchronousNonBlockingStepExecution.java:47)

    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)

    at java.util.concurrent.FutureTask.run(FutureTask.java:266)

    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)

    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)

    at java.lang.Thread.run(Thread.java:748)

     

    Kindly help me here.

     

    Thanks,

    Nishi

    Expand Post
    • 334 views

  3. Nishisharma1809 (Community Member) asked a question.

    November 24, 2021 at 8:16 AM
    Ran into problem when generating scan results in Jenkins. Error: [ConnectException, Connection timed out (Connection timed out)]
    java.net.ConnectException: Connection timed out (Connection timed out)

    Getting the above error, while ran a static scan on Jenkins integration with VERACODE.

    • 3 answers
    • 547 views
    1 of 3

  4. ChaitanyaChunchu345364 (Community Member) asked a question.

    October 12, 2021 at 6:58 AM
    Ran into problem when generating scan results in Jenkins. Error: [IllegalArgumentException, The credentials are not in the correct format.]

    Jenkins job showing following error after the scan finished,

     

    "[21.10.08 17:34:09] The scan finished with policy status 'Pass'.

     

    Ran into problem when generating scan results in Jenkins. Error: [IllegalArgumentException, The credentials are not in the correct format.]

    java.lang.IllegalArgumentException: The credentials are not in the correct format.

    at com.veracode.http.Credentials.<init>(Credentials.java:62)

    at com.veracode.http.Credentials.create(Credentials.java:23)

    at com.veracode.apiwrapper.wrappers.UploadAPIWrapper.setUpApiCredentials(UploadAPIWrapper.java:78)

    at com.veracode.jenkins.plugin.utils.WrapperUtil.setupCredential(WrapperUtil.java:29)

    at com.veracode.jenkins.plugin.utils.WrapperUtil.getBuildInfo(WrapperUtil.java:73)

    at com.veracode.jenkins.plugin.VeracodePipelineRecorder.getScanResults(VeracodePipelineRecorder.java:749)

    at com.veracode.jenkins.plugin.VeracodePipelineRecorder.perform(VeracodePipelineRecorder.java:385)

    at jenkins.tasks.SimpleBuildStep.perform(SimpleBuildStep.java:123)

    at org.jenkinsci.plugins.workflow.steps.CoreStep$Execution.run(CoreStep.java:99)

    at org.jenkinsci.plugins.workflow.steps.CoreStep$Execution.run(CoreStep.java:69)

    at org.jenkinsci.plugins.workflow.steps.SynchronousNonBlockingStepExecution.lambda$start$0(SynchronousNonBlockingStepExecution.java:47)

    at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)

    at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)

    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)

    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)

    at java.base/java.lang.Thread.run(Thread.java:829)

    "

    Expand Post
    • 1 answer
    • 1.22K views

    • Jason M., Veracode Support (Veracode)

      Hello @ChaitanyaChunchu345364 (Community Member)​ ,

       

      The error message indicates the ID for authenticating with the Veracode Analysis Center is not in the expected format. There is another Community Post that has a similar issue that you can read over if you want. Another suggestion is to ask a question in the @Integrations Group​ to see if they can provide more details about the Jenkins credentials error.

       

      Jason

      Community Support Engineer

      Expand Post

  5. MClarkson676368 (Community Member) asked a question.

    Edited by Shuning, Veracode Community Manager May 21, 2021 at 5:38 PM
    Pipeline Scan JSON to JUNIT XML

    Has anyone written a parser to convert the Pipeline Scan JSON output file to the JUNIT XML file format for easier visibility of results within the CI pipeline.

    My particular use case is for Gitlab CE (hence no sec dashboard) and it would be nice to have the results presented under the pipeline test tab for easy consumption by the devs.

     

    Thanks,

     

    Michael

     

    @Integrations Group​ 

    Expand Post
    • 4 answers
    • 1.42K views
    1 of 4

    • DBasu874440 (Community Member)

      Hello @MClarkson676368 (Community Member)​ , Thank you for the feedback. I am a Product Manager and would love to learn more about the problem you mentioned (present results for easy consumption by devs). Sending you a quick email requesting time to discuss in depth.

       

      Deepro.

  6. Veracode Base Camp — Shuning, Veracode Community Manager (Veracode) asked a question.

    Edited April 23, 2021 at 2:50 PM
    Example: Implementing Veracode Static Analysis in a Large Azure Project

    Hi everyone! If you’re implementing the Veracode Static Analysis in an Azure environment, this blog post from the Microsoft team may help you get started. Stephanie @SVisser067951 (Community Member)​, a software engineer at Microsoft leading this integration project, documented their process of implementing Veracode SAST into a large Azure DevOps pipeline for their customer. In her blog post, you will find: 

     

    • The scenario: a large Azure DevOps pipeline for an extensive mono-repository that spanned teams, projects, and languages and that needs to be integrated with Veracode. 
    • The four developer user stories identified for the different Static Scan types (IDE Scan, Pipeline Scan, Policy Scan, Sandbox Scan). 
    • How each scan type is used to address the four developer user stories. 
    • The main challenges and how those are resolved. 

     

    In this GitHub repo, you’ll also find the accompanying Azure DevOps pipeline YAML files that you can reference to get started with your own pipelines! 

     

    Questions, feedback for Stephanie? Post them in the comment section below 🙂👇

     

    @Integrations Group​ 

    Expand Post
    • 6 answers
    • 1.1K views
    EGertis462759 and HemantShah like this.
    1 of 6

  7. Product Announcements — Shuning, Veracode Community Manager (Veracode) asked a question.

    February 11, 2021 at 4:45 PM
    🚩Weekly Product Update (02.11.21): Analytics and Azure, plus More Static Support

    Here's your summary of the latest and greatest Veracode features:

     

    #Veracode Platform​ 

    • New Static Analysis Findings Information in Veracode Analytics - more details about findings that relate to your Static Analysis scans, including the function name, class path, and most recent line number in which Veracode discovers the findings. This data enables you to recreate a similar view as the Triage Flaw view in the Veracode Platform, but across multiple application profiles. 
    • New Security Program Overview Dashboard in Veracode Analytics - a new dashboard that contains data to help you track and understand how your AppSec program is trending, based on your target goals. With this dashboard, you can see current and historical trends for policy compliance, as well as better understand policy compliance behavior. New information available to you includes details such as how an application is meeting compliance over time. 

     

    #Azure DevOps​ 

    Veracode Azure DevOps Extension version 3.4.0 includes these updates: 

    • Use YAML to add Veracode analysis to build pipelines. 
    • Use YAML to import findings as work items into Azure DevOps. 
    • Include mitigation and annotation comments when importing new findings as work items. 
    • Set a timeout to fail a build if Veracode analysis does not complete within a specified time

     

    #Veracode Static Analysis​ 

    • New Veracode Static Analysis Support for GCC 9, Koa.js, Hibernate Framework, and Autofac Framework 
    • Improved Veracode Static Analysis Results for Android, PHP, and Python Applications 
    • Improved Prescan Warning Messages 
    • Improved Results Consistency for Java Applications 
    • Improved Results Accuracy Within JSP Files 

     

    @Integrations Group​ @Analytics Group​ 

    Expand Post
    • 373 views
    eric likes this.

  8. aleks_j (Community Member) asked a question.

    January 27, 2021 at 3:50 PM
    Hi All, Is the 'Veracode Static for Visual Studio' plugin compatible with all three Visual Studio 2019 versions: Enterprise, Professional and Community version? Thanks!
    Question with a best answer.

    Best Answer

    Hello @aleks_j (Community Member)​ ,

    Yes, the Veracode Visual Studio Extension is compatible with the different versions of Visual Studio including Enterprise, Professional, and Community.

     

    There are two extensions available for Visual Studio, the IDE extension for scanning individual modules

    and the Static Extension available for either sandbox or policy scanning.

     

    The Veracode Communities Support Matrix outlines the supported environments for the Veracode Extensions,

    https://community.veracode.com/s/article/Support-Matrix

     

    The Help Center has the actual installation instructions for the Static extension,

    https://help.veracode.com/r/c_title_VS

     

    The IDE extension can be installed here,

    https://help.veracode.com/r/Pik27SOP_AxJoGJrh7OENQ/pwLlVr6CMOwL3gXQH8Lebg

     

    Please follow the installation instructions for either or both of these extensions and let us know if you have

    any questions.

     

    Also, note that we will soon be combining both the IDE scanning extension capability for individual module scanning and the Static extension into one extension. Stay tuned here for the upcoming release notifications.

    Expand Post
    Stephen J., Veracode Support by Stephen J., Veracode Support (Veracode, Inc.)
    • 1 answer
    • 301 views
    aleks_j likes this.

    • Stephen J., Veracode Support (Veracode, Inc.)

      Hello @aleks_j (Community Member)​ ,

      Yes, the Veracode Visual Studio Extension is compatible with the different versions of Visual Studio including Enterprise, Professional, and Community.

       

      There are two extensions available for Visual Studio, the IDE extension for scanning individual modules

      and the Static Extension available for either sandbox or policy scanning.

       

      The Veracode Communities Support Matrix outlines the supported environments for the Veracode Extensions,

      https://community.veracode.com/s/article/Support-Matrix

       

      The Help Center has the actual installation instructions for the Static extension,

      https://help.veracode.com/r/c_title_VS

       

      The IDE extension can be installed here,

      https://help.veracode.com/r/Pik27SOP_AxJoGJrh7OENQ/pwLlVr6CMOwL3gXQH8Lebg

       

      Please follow the installation instructions for either or both of these extensions and let us know if you have

      any questions.

       

      Also, note that we will soon be combining both the IDE scanning extension capability for individual module scanning and the Static extension into one extension. Stay tuned here for the upcoming release notifications.

      Expand Post
      Selected as Best

End of Feed
8 Chatter Feed Items

Group Details

Details

Description
The Integrations Group is where you can engage with other Community members, including Veracoders, on your experiences around integrating Veracode into your environment.
Show More
Information

Have you created an API or plugin for your unique environment? Share your efforts in the Veracode Community, where you can invite other Community members to test your solution in other environments.

Interested in engaging other perspectives across your peers on how they have successfully integrated Veracode into their environments? Begin the conversation here.

Want to continue a dialogue from a Veracode Webcast or event around integrations? There's no need for that conversation to end...continue it here in the Integrations Group.

Show More
Owner
Tim J (Veracode PM)