absolutely @Sohlae (Community Member)​ 

For SCA Agent-based scans:

Set up and agent scan and workspace

1. Access the Platform >> Scans & Analysis >> Software Composition Analysis >> Agent based Scans >> Actions >> Create a workspace >> give a name >> Click on 'More Options" >> Select the teams that you would like to share the reports
2. Enter into workspace created >> left side >> click on Agents
3. Now you can create agents based on Operate System that yours pipelines works

Linux/Mac agent pools

1. Into agents, click on green button "Actions" >> create >> select any Integration options like bellow

1. Click "create and generate token"
2. Into your Azure Pipelines, create a variable into it named as SRCCLR_API_TOKEN and the value must be the token generated earlier
3. Now, you can run SCA agent-based scan running a script like bellow:

 - task: CmdLine@2

      inputs:

        script: |

                export SRCCLR_API_TOKEN=$(SRCCLR_API_TOKEN)

                export SRCCLR_SCM_URI=$(Build.Repository.Uri)

                export SRCCLR_SCM_REF=$(Build.SourceBranchName)

                export SRCCLR_SCM_REF_TYPE="branch"

                export SRCCLR_SCM_REV=$(Build.SourceVersion)

                curl -sSL https://download.sourceclear.com/ci.sh | bash -s – scan  --allow-dirty --update-advisor --uri-as-name || true

      displayName: 'Veracode SCA - Agent-Based Scan' 

Windows 

1. For windows agent pools, you'll need to create a Windows agent    
2. Click into it and then select "Power Shell"
3. Create the same variable into Azure Pipelines called  SRCCLR_API_TOKEN
4. Click on "create and generate token" and put the token value into Variable on Azure Pipelines
5. Run the script bellow into a powershell task

$env:SRCCLR_API_TOKEN

$env:SRCCLR_API_TOKEN='$(SRCCLR_API_TOKEN)'

$env:SRCCLR_SCM_URI='$(Build.Repository.Uri)'

$env:SRCCLR_SCM_REF='$(Build.SourceBranchName)'

$env:SRCCLR_SCM_REF_TYPE='branch'

$env:SRCCLR_SCM_REV='$(Build.SourceVersion)'

Set-ExecutionPolicy AllSigned -Scope Process -Force

$ProgressPreference = "silentlyContinue"; iex ((New-Object System.Net.WebClient).DownloadString('https://download.sourceclear.com/ci.ps1'))

srcclr scan $(local path that you app is in)

---

Note: always review the pre requeriments for your language example:

.NET >> https://docs.veracode.com/r/c_sc_net

Java >> https://docs.veracode.com/r/c_sc_java

JavaScript >> https://docs.veracode.com/r/c_sc_javascript

@Sohlae (Community Member)​ 

At the moment no, but you can create a scope or working on in a specific configurations for yours scans to be more directly.

Direcotry Restrictions

1. Directory and Subdirectories: allow the scan to crawl within the specified directory and any subdirectories, but not to crawl up from the starting point.
2. Directory Only: allow the scan to stay within the specified directory and not crawl up or down from it.
3. No Restrictions: allow the scan to crawl up and down from the specified directory.

Similarity Threshold

Control which web pages the analysis ignores based on the similarity of the content on each page. The scanner compares each web page with the other pages it previously scanned to identify pages with similar content. 

1. Most Strict the analysis will include all pages, regardless of similarity of pages already analyzed.
2. Least Strict will ignore similar pages already analyzed.

URL Blocklist

Exclude URLs that you do not want the Dynamic Analysis to scan.

Crawl Script

You can create a script using the Selenum IDE browser extension that it will record all interactions that you do in your browser tab app screen. In this case, would be possible to create a "path" that the scanner would the follow and only test pages and URLs that you recorded.

Links to help you

• https://docs.veracode.com/r/t_was_crawl_script
• https://docs.veracode.com/r/Selenium_Commands_Supported_in_Dynamic_Analysis

• https://chrome.google.com/webstore/detail/selenium-ide/mooikfkahbdckldjjndioackbalphokd

@Sohlae (Community Member)​ 

I know that you can update manually or via script, using tools like "sed", "echo" etc... depends of you operate system and script language that you prefer.

As a example, here we have a script into Azure Devops, executed into a CMD task. The script create a json with many parameters using echo

https://github.com/jphillips-vc/Veracode-Dynamic-Analysis-Azure-Example/blob/master/ado-da-example.yaml