Hello @SNukala533233 (Community Member)​ ,

Thank you for your post. Reviewing the screenshot that you've shared, it looks like your Veracode static scan request was configured to scan a known 3rd party DLL (Microsoft.ApplicationInsights.SnapshotCollector.dll). Veracode does not recommend selecting 3rd party DLLs as modules to scan with static analysis here, as the findings that are reported back from 3rd party DLLs are usually irrelevant and not actionable/optimal results that your team can resolve here. Upgrading the version number for instance will not do anything here since the Veracode static analyzer does not consider application versions when reporting CWE flaws it finds in a scanned DLL module. The Software Composition Analysis (SCA) scan is the appropriate scan here which would recognize and understand version number upgrades -- this is how we recommend you should be scanning this 3rd party DLL here instead of a static scan. Note that a .NET SCA scan takes place as part of a static upload and scan request when your .NET application is packaged based on the instructions that are posted at https://docs.veracode.com/r/compilation_net#software-composition-analysis.

Please refer to our guide on module selection recommendations and best practices for more details https://community.veracode.com/s/article/What-are-Modules-and-how-do-my-results-change-based-on-what-I-select . A proper static scan module selection configuration is to only select 1st party modules that correspond to the application you've developed, and which reflect how users will "enter" and call into your application. We recommend revisiting the module selection for your scans to de-select scanning this 3rd party DLL, as well as any other selected 3rd party DLLs. Please select only appropriate 1st party modules as the static scan entry points. Please refer to our documentation on how to update your most recent scan's module selection and re-scan -> https://docs.veracode.com/r/t_rescan. 3rd party modules that your 1st party application leverages should still be included as part of the upload to Veracode to assist with the scanning and modelling of selected 1st party modules (as well as to perform the SCA scan in parallel).

Hope this information helps. If you still have any questions about your specific static scan results and static scan configuration, we recommend scheduling a consultation call as a next step to go over new details you want to discuss. You can check out https://docs.veracode.com/r/t_schedule_consultation for how to schedule a consultation call with our team.

Best Regards,

Andrew Bell