Veracode

About Veracode

You can connect OX to Veracode to import application security findings. This lets you review Veracode results alongside the rest of your findings in OX, with the same prioritization, workflows, and reporting.

Veracode runs static analysis, software composition analysis, and dynamic analysis against your applications. OX reads your Veracode applications and their findings through the Veracode REST API, maps them to your OX applications, and keeps them updated on every scan.

After the connection is established, OX imports your Veracode applications, their findings for the connected scan types, and the CWE catalog that Veracode uses to classify them.

Findings appear on the Active Issues page. To display Veracode findings, filter by Source tool > Veracode.

Each connector category has its own credentials, so you can connect different categories to different Veracode regions or credential pairs.

What OX imports from Veracode

The Veracode connector appears in several categories on the Connectors page, one for each scan type OX imports.

Category on the Connectors page	Veracode scan type	What OX imports
Code Security (Static Analysis)	Static	Static findings, with the flaw details Veracode records for each one.
Open Source Security	SCA	Software composition analysis findings, including the affected component and CVE.
Dynamic App Security	Dynamic	Dynamic findings from scans against your running applications.

Connect the connector in each category you want OX to pull. Each category imports separately, so you can start with one and add the others later.

Terminology mapping

Veracode and OX use different labels for similar concepts. Use this map while you work.

Veracode	OX Security
Applications	Applications
Findings	Issues
Scan type (Static, SCA, Dynamic)	Source category
CWE	Issue category
Severity	Severity

Prerequisites

• Veracode account: An account with a role that can generate API credentials, such as Administrator or a role that includes API access.

• OX permissions: Permission to configure connectors.

Step 1: Generate Veracode API credentials [Veracode]

OX authenticates to Veracode with an API ID and API key pair, signed with Veracode's HMAC scheme on every request.

1. Sign in to the Veracode Platform.

2. Select your account name in the upper-right corner, then select Account Settings.

3. Go to API Credentials.

4. Select Generate API Credentials.

5. Copy the API ID and API key, then store them in a secure location.

Note: Veracode shows the API key only once.

Veracode API credentials expire, and a Veracode account holds a limited number of active credential pairs. Generate a new pair before the current one expires, then update the values in OX.

Step 2: Connect Veracode to OX [OX]

1. In the OX platform, go to the Connectors page.

2. In the search box, enter Veracode. The Veracode connector appears under each category it supports.

3. Select the Veracode card in the category you want to import. The Configure your Veracode credentials box opens.

1. On the API Secret & API Access key tab, provide the following details:

Field	What to use
Veracode Host URL	The regional API host for your Veracode account. The box is prefilled with https://api.veracode.com. Accounts in the European region use https://api.veracode.eu.
API Access key	The API ID from Step 1.
API Secret Key	The API key from Step 1.

1. Select Verify Connectivity to confirm OX reaches Veracode with the values you entered.

2. Select Connect.

3. To choose which Veracode applications OX imports, select the gear icon next to Delete, select the applications you want, then select Save.

Note: The gear icon becomes active after the connection succeeds. Select it to limit the import to specific Veracode applications.

Repeat Step 2 for each category you want OX to import.