Som (Community Member) asked a question.
How to integrate Veracode Dynamic Analysis in Azure DevOps Pipeline
In our project, build part is on premise using Bamboo. Hence Veracode static analysis is integrated in Bamboo. Once application is deployed, we want to do the Veracode dynamic analysis in Azure DevOps release pipeline. In Upload and Scan option, I am not getting how to run dynamic analysis. Can anyone please help? This requirement is a part of the story in agile sprint. Hence any quick response will be highly appreciated. Thanks in advance.
.png){kind=logo}
Hello @Som (Community Member) ,
We don’t have a plugin for for Bamboo and a new script would have to be developed using the Dynamic Analysis API’s. There is a Help Article that has more information on creating that API: https://help.veracode.com/reader/orRWez4I0tnZNaA_i0zn9g/ca9kKngOeZvMUsWlyhXJLw
Jason
Community Support Engineer
@Som (Community Member)
One of our Solution Architects advised to check out https://github.com/jphillips-vc/Veracode-Dynamic-Analysis-Azure-Example as it has a project to what you are looking for.
Jason
Community Support Engineer
@Jason M., Veracode Support (Veracode) Som's question was actually about integrating into Azure DevOps not Bamboo, which is the same question I have.
I reviewed the example you posted, I believe it is for creating a new scan. I want to just trigger an existing scan and get the status.
In general, provided this is achievable, either by an extension in Azure DevOps, or REST API calls (it looks like it would be submitdynamicscan.do and getdynamicstatus.do, is it even reasonable to expect to include it in a release pipeline?
e.g. submitting, getting the results, succeeding or failing based on the status? I'm looking at the last run for a scan and it said it took 37 minutes. Obviously the release pipeline can't wait that long. SAST has the concept of the "pipeline scan" which is a quicker scaled down version of the policy scan, is there anything like that for Dynamic Scans?
If the timing is that long, then I am just thinking that submitting it is going to have to do and it can't really be tied to success or failure--someone will have to manually go look at the results.
So looking for confirmation whether there is AzDO Dynamic Scan extension, if not, is there an example of submitudynamicscan.do that someone has done that you are aware of within AzDO? And then confirmation of the practicality of tieing a scan to the success of a release.
Hello @DHahn197985 (Community Member) ,
You can leverage the examples in the Help center (https://help.veracode.com/reader/orRWez4I0tnZNaA_i0zn9g/FGQrarQxSqT5hwzxCo54sA) as well as this article (https://github.com/aszaryk/verademo/blob/master/jenkins-update-da-scan.py) to see what calls need to be made to update an existing job. Once that is adjusted, you just need to update the scan date/time and resubmit it.
Jason
Community Support Engineer