HCL AppScan

About HCL AppScan

You can connect OX to HCL AppScan on Cloud to import application security findings. This lets you review AppScan results alongside the rest of your findings in OX, with the same prioritization, workflows, and reporting.

HCL AppScan is a family of application security testing and vulnerability management tools from HCLTech. OX reads your AppScan applications and their open issues through the AppScan API, maps them to your OX applications, and keeps them updated on every scan.

After the connection is established, OX imports issues with the Open, In Progress, or New status for every AppScan application in scope. Imported information includes the AppScan issue article: cause, risk, fix recommendation, CWE, and references.

Findings appear on the Active Issues page. To display HCL AppScan findings, filter the Active Issues page by Source tool > HCL AppScan.

Each connector category has its own credentials, so you can connect different categories to different AppScan hosts or keys.

What OX imports from HCL AppScan

The HCL AppScan connector appears in several categories on the Connectors page, one for each type of testing OX imports.

Category on the Connectors page	What OX imports
Code Security (Static Analysis)	Static analysis issues that AppScan finds in your source code.
Open Source Security	Software composition analysis issues, including the library, version, and CVE that AppScan matched.
Dynamic App Security	Dynamic analysis issues that AppScan finds against your running applications.
Infrastructure as Code Scan	Issues that AppScan finds in infrastructure definition files.
Secret/PII Scan	Exposed secrets and personally identifiable information that AppScan detects.

Connect the connector in each category you want OX to pull. Each category imports separately, so you can start with one and add the others later.

Terminology mapping

HCL AppScan and OX use different labels for similar concepts. Use this map while you work.

HCL AppScan	OX Security
Apps	Applications
Issues	Issues
Discovery method (SAST, SCA, DAST)	Source category
Severity (Informational, Low, Medium, High, Critical)	Severity

Prerequisites

• HCL AppScan on Cloud account: An account that can open Tools > API and generate a key.

• OX permissions: Permission to configure connectors.

Step 1: Generate an API key ID and key secret [HCL AppScan]

OX authenticates to AppScan with a key ID and key secret pair that you generate in your AppScan account.

1. Sign in to HCL AppScan on Cloud.

2. In the left sidebar, go to Tools > API.

3. Select Generate to create a key.

4. Copy the Key ID and Key Secret, then store them in a secure location.

Note: AppScan shows the secret once.

The OX credentials box links to the AppScan page where you generate these values. Select Generate Key ID and Key Secret to open it in a new tab.

Step 2: Connect HCL AppScan to OX [OX]

1. In the OX platform, go to the Connectors page.

2. In the search box, enter AppScan. The HCL AppScan connector appears under each category it supports.

3. Select the HCL AppScan card in the category you want to import. The Configure your HCL AppScan credentials box opens.

4. To see the in-product steps for getting your key, select INSTRUCTIONS TO GET HCL CLIENT ID AND CLIENT SECRET KEY.

1. On the API Secret & API Access key tab, provide the following details:

Field	What to use
HCL AppScan Host URL	The base URL of your AppScan service. The box is prefilled with https://cloud.appscan.com/. Replace it only if your organization uses a different AppScan host.
API Access key	The Key ID from Step 1.
API Secret Key	The Key Secret from Step 1.

1. Select Verify Connectivity to confirm OX reaches AppScan with the values you entered.

2. Select Connect.

3. To choose which AppScan apps OX imports, select the gear icon next to Delete, select the apps you want, then select Save.

Note: The gear icon becomes active after the connection succeeds. Select it to limit the import to specific AppScan apps.

Repeat Step 2 for each category you want OX to import.