Hello!

I have been working on some open source tools to help me do my job of remediating flaws in large customer estates with Veracode. Hopefully you might find them useful too. I’m still working on these so expect updates & breakages, please feel free to raise suggestions or fork.

VeracodeServicesCore

https://github.com/sebcoles/VeracodeServicesCore

This is a .NET Core NuGet package that wraps the data retrieval capability of the XML APIs and returns hydrated classes for consumption. It is not as complete as the supported Veracode wrappers, but I hope the object mapping may save someone some time if they are just pulling data. The returned classes are the complete XSD schema definition (your getting everything, some of which is no longer supported FYI).

VeraData

https://github.com/sebcoles/VeraData

This is another .NET Core console application that retrieves data using the above NuGet package but maps it to a leaner relational model and pumps it into a MS SQL Server database. This will include scans, flaws, pre scan errors, modules, uploaded files etc. This is to enable you to plugin in your favourite BI tool to ask questions of your estate, enabling dashboards and insights.

VeraHooks

https://github.com/sebcoles/VeraHooks

VeraHooks is a proof of concept to allow webhooks when mitigations are raised. The solution includes a portal for configuring webhooks against applications, what endpoint to POST to and what conditions they need to meet (such as Mitigate by Design or Mitigate by OS). The webhooks are then processed on agents. The purpose of the tool is to enable workflows such as directing notifications for types of mitigations to different user groups, for example a slack channel.

Effective appsec is all about developer engagement. Providing insightful visualisations and rapid feedback go along way to building an appsec service that engineering teams will want to engage with. They are all active pet projects (so completely unsupported and forever in Alpha) but I hope they help you improve your engagement.

Thanks, Seb