SPatel108606 (Community Member) asked a question.
Does Veracode Greenlight allow custom policy setup like Veracode static scan
Our Veracode static scan results include items flagged as "Fix Required by Policy". But, while the Greenlight Eclipse plugin does also find these items, it only flags them as Medium or low instead of High or Very High. The tool isn't useful if we can't use it to pre-screen/fix severe flaws that will show up in the submitted scan.
Is there some way to get the two scan methods to agree with each other? E.g., a way to configure Greenlight with the same "policy" that's applied to the static scan?
.png){kind=logo}
Hello There!
You're right, having different severity levels assigned to the same findings between Veracode Static Scan and Greenlight Eclipse plugin can be frustrating. Here are some ways to potentially achieve more consistency:
Veracode Policy Configuration:
Review your Veracode security policy settings. The "Fix Required by Policy" flag likely originates from specific rules or CWE (Common Weakness Enumeration) categories configured in your policy.
Analyze the policy and see if there's a way to adjust the severity levels for those specific rules or CWEs. You might be able to configure the policy to mark them as "High" or "Very High" if they truly represent severe flaws.
Greenlight Configuration (Limited Options):
Unfortunately, Greenlight doesn't offer extensive configuration options for severity levels directly tied to Veracode policies. However, you might be able to find some workarounds:Greenlight Best Practices: Greenlight highlights potential security best practices alongside findings. Analyze these best practices and see if they align with the "Fix Required by Policy" findings in Veracode Static Scan. If they do, addressing these best practices flagged by Greenlight might indirectly mitigate the policy violations.
>> Here are some additional resources that you might find helpful:
Veracode Platform: Security Policy Management: https://docs.veracode.com/r/policy_app
Veracode Greenlight Documentation: https://docs.veracode.com/r/Veracode_Greenlight
For more support on this, please contact our technical support team.
Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, and click on your user avatar.
2. Select Contact Support from the drop-down menu. Open a case with Support, for Static Scan and your queries will be addressed.
Thanks & Regards,
Veracode!