eric (Community Member) asked a question.

May 1, 2021 at 9:07 AM
Consolidated reporting and policy results with agent-based SCA

I cannot make our existing Veracode reports (Veracode Detailed Report or Veracode Customized Report) show the agent-based SCA results. What can we do to get a complete report (Veracode SA + DA + agent-based SCA)?

I was hoping to be able to pull an integrated report (with SAST results) and make sure that the SourceClear results would also affect the policy results for the linked app. Is this in the roadmap?

  • 2 answers
  • 323 views
JDruley177883 likes this.

  • eric (Community Member)

    Hello Jason,

    Thanks for your answer. For me, this seems inaccurate. When I download the Veracode Customizable Report, it looks like I'm getting the SCA results from the upload-based SCA (triggered by Static Analysis) -- NOTE: both sets of results vary slightly. In case it makes a difference, I linked the agent-based SCA results after the static analysis. Therefore, to get a report for agent-based SCA, I can only do it via the Agent-Based Scan web UI. Our Veracode rep. confirmed that this is not yet supported and there will be a future release that supports integrated reports (including agent-based). Do let me know if there's something else to be tried. On our end, I don't think we can remove the upload-based SCA results so its results always take precedence in our reports.

    ​

    But I realize I should have entered this under the Ideas section which I'll do shortly...

    Expand Post
    Selected as Best

  • Jason M., Veracode Support (Veracode)

    Hello @eric (Community Member)​ ,

     

    It is possible to have a complete report of the Static Analysis, Dynamic Analysis, and Agent Based SCA results by using customized reports (Understanding the Customizable Report). In order to get the results for the SCA agent on the report, you will need to link the application profile to it (Link SCA Projects to Application). When it is linked, the report should inform you of the SourceClear results affecting the policy reports.

     

    Jason

    Veracode Support Engineer

    Expand Post

    • eric (Community Member)

      Hello Jason,

      Thanks for your answer. For me, this seems inaccurate. When I download the Veracode Customizable Report, it looks like I'm getting the SCA results from the upload-based SCA (triggered by Static Analysis) -- NOTE: both sets of results vary slightly. In case it makes a difference, I linked the agent-based SCA results after the static analysis. Therefore, to get a report for agent-based SCA, I can only do it via the Agent-Based Scan web UI. Our Veracode rep. confirmed that this is not yet supported and there will be a future release that supports integrated reports (including agent-based). Do let me know if there's something else to be tried. On our end, I don't think we can remove the upload-based SCA results so its results always take precedence in our reports.

      ​

      But I realize I should have entered this under the Ideas section which I'll do shortly...

      Expand Post
      Selected as Best

Topics (2)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.