Configure user-created security tool

Connect your custom security tool that is integrated with your CI/CD pipelines to DevOps Change Velocity to retrieve security scan results.

Before you begin

You must create the application vulnerability integration by following the step-by-step instructions in the Configure DevOps with Application Vulnerability Response for better visibility into CI/CD pipeline [KB1441741] enablement guide. This is a required pre-requisite setup to onboard your custom security tool from DevOps Change Velocity.

Role required:

• Developer role for the scoped app
• DevOps admin role

Note:

When creating an integration as a scoped app, the system admin must assign these roles to the integration developer, so the integration developer is able to create tool integration and integration capability records for the specific scope.

Procedure

1. Navigate to DevOps > Integrations > Tool Integrations and create a record to define the tool you are integrating.
2. Select New, and enter the following values in the form fields.

   Field	Value
   Tool label	Name of the tool integration.
   Integration version	Version of the tool integration.

   
3. Select Submit.
4. Open the newly created tool integration and navigate to the Tool Integration Capability Mappings related list.
5. Select New, and enter the following values in the form fields.

   Field	Value
   Tool integration	Sample tool
   Tool type capability	Security

   
6. Select Submit.
7. Navigate to the Integration Capabilities related list, and select New.
8. Create the Connect and Validate records by entering the following values in the form fields.

   Field	Value
   Tool integration	Sample Code Tool
   Capability mapping	Capability mapping record created in step 6.
   Action	Connect Note: Do not edit tool action records.
   Active	Selected
   Timeout (ms)	Timeout for the corresponding subflow. If execution of the subflow exceeds this value, a timeout exception occurs. Value is in milliseconds (ms). Default is 45,000 (45 seconds).
   Subflow name	For Connect: sn_devops_vul_ints.security_tool_connect For Validate: sn_devops_vul_ints.security_tool_validate
   Domain	global

   
9. Open the newly created tool integration record and add the SecOps source integration and Integration handler name fields to the form by navigating to Configure > Form layout.
   In the tool integration form, enter the following values for these fields.

   • SecOps source integration: Select the source integration that is created in the Third Party Integrations (sn_sec_int_integration) table as described in the Configuration page > Steps to create a configuration section in the Configure DevOps with Application Vulnerability Response for better visibility into CI/CD pipeline [KB1441741] enablement guide.
   • Integration handler name: sn_devops_vul_ints.DevOpsSecurityToolIntegrationHandler
10. Ensure that "Tool Integration name" DevOps Integration (example: Veracode DevOps Integration) is created in the Application Vulnerability Integration (sn_vul_app_integration) table and mapped to the source integration that is created in the Third Party Integrations (sn_sec_int_integration) table as described in the Configuration page > Steps to create a configuration section in the Configure DevOps with Application Vulnerability Response for better visibility into CI/CD pipeline [KB1441741] enablement guide.

What to do next

By default, when you onboard your tool from workspace, you have to enter the mandatory fields as defined in the Configuration Page section in the Configure DevOps with Application Vulnerability Response for better visibility into CI/CD pipeline [KB1441741] enablement guide. Not all the mandatory fields are credential fields. In the base system, all the mandatory fields are displayed while updating credentials. If you want to update the credentials for this tool when the credentials have expired, you may not want to enter all the mandatory fields. To configure the mandatory fields that you want to show in the Update credentials page, perform the following steps.

1. Navigate to Now Experience Framework > Experiences.
2. Select DevOps Change Workspace.
3. On the UX Page Properties related list, select securityToolsUIConfig.
4. Add the following entry to the JSON.

   <tool_integration_sys_id> : { 
      "CREDENTIAL_PAGE": { 
         "FIELDS_TO_SHOW": [ 
            "<parameter_1>", 
            "<parameter_2>"     
                       ] 
     } 
   }