> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-integrations/3rd-party-integrations/code-security-static-analysis/hcl-appscan.md).

# HCL AppScan

## About HCL AppScan

You can connect OX to HCL AppScan on Cloud to import application security findings. This lets you review AppScan results alongside the rest of your findings in OX, with the same prioritization, workflows, and reporting.

HCL AppScan is a family of application security testing and vulnerability management tools from HCLTech. OX reads your AppScan applications and their open issues through the AppScan API, maps them to your OX applications, and keeps them updated on every scan.

After the connection is established, OX imports issues with the Open, In Progress, or New status for every AppScan application in scope. Imported information includes the AppScan issue article: cause, risk, fix recommendation, CWE, and references.

Findings appear on the Active Issues page. To display HCL AppScan findings, filter the Active Issues page by **Source tool > HCL AppScan**.

Each connector category has its own credentials, so you can connect different categories to different AppScan hosts or keys.

### What OX imports from HCL AppScan

The HCL AppScan connector appears in several categories on the Connectors page, one for each type of testing OX imports.

| Category on the Connectors page | What OX imports                                                                                     |
| ------------------------------- | --------------------------------------------------------------------------------------------------- |
| Code Security (Static Analysis) | Static analysis issues that AppScan finds in your source code.                                      |
| Open Source Security            | Software composition analysis issues, including the library, version, and CVE that AppScan matched. |
| Dynamic App Security            | Dynamic analysis issues that AppScan finds against your running applications.                       |
| Infrastructure as Code Scan     | Issues that AppScan finds in infrastructure definition files.                                       |
| Secret/PII Scan                 | Exposed secrets and personally identifiable information that AppScan detects.                       |

Connect the connector in each category you want OX to pull. Each category imports separately, so you can start with one and add the others later.

### Terminology mapping

HCL AppScan and OX use different labels for similar concepts. Use this map while you work.

| HCL AppScan                                           | OX Security     |
| ----------------------------------------------------- | --------------- |
| Apps                                                  | Applications    |
| Issues                                                | Issues          |
| Discovery method (SAST, SCA, DAST)                    | Source category |
| Severity (Informational, Low, Medium, High, Critical) | Severity        |

### Prerequisites

* HCL AppScan on Cloud account: An account that can open Tools > API and generate a key.
* OX permissions: Permission to configure connectors.

### Step 1: Generate an API key ID and key secret \[HCL AppScan]

OX authenticates to AppScan with a key ID and key secret pair that you generate in your AppScan account.

1. Sign in to HCL AppScan on Cloud.
2. In the left sidebar, go to **Tools > API**.
3. Select **Generate** to create a key.
4. Copy the **Key ID** and **Key Secret**, then store them in a secure location.

> **Note:** AppScan shows the secret once.

The OX credentials box links to the AppScan page where you generate these values. Select **Generate Key ID and Key Secret** to open it in a new tab.

### Step 2: Connect HCL AppScan to OX \[OX]

1. In the OX platform, go to the **Connectors** page.
2. In the search box, enter **AppScan**. The HCL AppScan connector appears under each category it supports.
3. Select the **HCL AppScan** card in the category you want to import. The **Configure your HCL AppScan credentials** box opens.
4. To see the in-product steps for getting your key, select **INSTRUCTIONS TO GET HCL CLIENT ID AND CLIENT SECRET KEY**.

<figure><img src="https://884876233-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdK3XMLdV8zRg847RmGmZ%2Fuploads%2Fgit-blob-aa16ba6da428e04c30568204bfea1712cdd639ba%2FHCL%20AppScan.png?alt=media" alt="" width="470"><figcaption></figcaption></figure>

5. On the **API Secret & API Access key** tab, provide the following details:

| Field                | What to use                                                                                                                                                       |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| HCL AppScan Host URL | The base URL of your AppScan service. The box is prefilled with `https://cloud.appscan.com/`. Replace it only if your organization uses a different AppScan host. |
| API Access key       | The Key ID from Step 1.                                                                                                                                           |
| API Secret Key       | The Key Secret from Step 1.                                                                                                                                       |

6. Select **Verify Connectivity** to confirm OX reaches AppScan with the values you entered.
7. Select **Connect**.
8. To choose which AppScan apps OX imports, select the gear icon next to **Delete**, select the apps you want, then select **Save**.

> **Note:** The gear icon becomes active after the connection succeeds. Select it to limit the import to specific AppScan apps.

Repeat Step 2 for each category you want OX to import.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.ox.security/ox-integrations/3rd-party-integrations/code-security-static-analysis/hcl-appscan.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.