Skip to main content

Creating and Configuring a SAST Project

Notice

Starting with version 9.4, Checkmarx SAST lets users choose how to handle multiple full and public scans of the same project being queued. For additional information, refer to the instructions on Advanced Actions6436170867.pngbelow.

To create a SAST project, do the following:

  1. Select Project & Scans >Create New Project.

    6436170864.png

  2. Configure the following General project properties:

    • Project Name - indicates the source code to be scanned and tracked. Project names cannot include the following characters: : ? ! / * " < > | ; & # $ ^

    • Preset - set of queries to be run on the code scan.

      Default includes a set of queries recommended by Checkmarx for most projects.

      Select the preset that best matches your application; for example, for an Android project, select Android. See the Vulnerability Queries section in the release notes for a full list of executed queries.

    • Configuration - determines the scan configuration. The configurations differ in how the projects are scanned, in terms of which languages are scanned and which flow calculations are used. For information about how to change default configurations, see Configuring CxSAST Scan Flow Processes. Select one of the following standard configurations:

      • Improved Scan Flow will scan the primary language (for example, Java, C#, and Python) with the most files and all secondary languages (for example, JavaScript, PL-SQL, and VBScript). For example, a project with 100 Java files, 50 Python files, and 60 JavaScript files will have only the Java and JavaScript scanned. The new Improved Scan Flow is similar to the older Default Configuration. Still, the Improved Scan Flow will only calculate the flow for the specified queries, significantly reducing the flow calculations duration and memory consumption. When SAST version 9.4 is installed, the Improved Scan Flow is the default.

      • Multi-language Scan will scan all languages, including multiple primary languages. If the same project with 100 Java files, 50 Python files, and 60 JavaScript files is scanned, all languages – Java, Python, and JavaScript will be scanned.

      • Default Configuration will scan the primary language (for example, Java, C#, and Python) with the most files and all secondary languages (for example, JavaScript, PL-SQL, and VBScript). For example, a project with 100 Java files, 50 Python files, and 60 JavaScript files will have only the Java and JavaScript scanned. This is no longer the default.

      • Fast Scan decreases the scanning time of projects, making it faster to identify relevant vulnerabilities and enable continuous deployments while ensuring that security standards are followed. This will help relevant personas like developers react much faster to what they need to tackle immediately. While the fast scan mode identifies the most significant and relevant vulnerabilities, the in-depth scan mode offers deeper coverage. For the most critical projects with a zero-vulnerability policy, it is advised also to use our in-depth scan mode.

    • Team - determines who can view your project and its scan results. Available options depend on the permissions of the logged-on user. Selecting CxServer allows access only to the server Administrator. If you're working as a single user, keep the default option.

  3. Click <Next>. You are asked for the location of the source code.

    6436170960.png

  4. Specify one of the following source code Location properties:

    Note

    SAST does not scan two files with the same name or files with special characters not supported in Windows.

    • Local - Click <Select> to browse a local file containing the code. Future scans of the project are also performed via local upload (see Managing Projects and Running Scans). For issues related to scanning large files, see Managing Large Files.

    • Shared - project code maintained on a network server accessible from the SAST Server. Click <Select>, provide your Windows domain credentials for SAST to access the network (username format: domain_name\user name), and select one or more network folders containing the project code.

      • Note that zipped source code is not supported for shared location scans. Extract the content of the zip file before scanning.

    • Source Control - project code maintained in TFS , SVN , GIT, or PerForce source control systems. Click <Select> (see Configuring the Connection to a Source Control System).

      • In cases where the project's source control location is defined as Git, the Git branch name is included under the Source Control field.

      • Files inside a zip file located inside a repository are not sent for scanning. Extract the content of the zip file to the repository before scanning.

    • Source Pulling - an extension to the Shared option above, Source Pulling first activates a custom-created script, which can pull source code from one or more repositories of a source control system into the specified Shared location, and only then will the scan be initiated on the pulled source code. This script must be previously configured in the SAST Windows client application, as described in Configuring Pre & Post Scan Action. The timeout for waiting for the script to finish is 15 minutes, typically more than enough time. Note that network and shared dialogs might not work on Localhost.

    • Optionally, you can exclude certain folders or files from the scan process. For details about the correct syntax, see Excluding Files from Scans.

  5. Click <Count Lines> to display the number of lines in the current project. Note that the Java Script is enhanced during the scan process. Therefore, the real count of lines might be larger than the result displayed by clicking Count Lines.

  6. Click Next>. The following steps of the wizard are optional. You can click <Finish> to skip them.

    Note

    Scheduling does not apply to a Local source code location since the SAST Server cannot access the local source automatically. You will need to upload a new zip file periodically manually.

    6436170963.png

  7. If required, configure the following scan execution Scheduling properties:

    • None - no schedule; you have to run the scan manually.

    • Now - defines an immediate scan.

    • By Schedule - define an automatic weekly scan according to the specified time.

      • Run on Weekdays - define on which day to run the periodic scan.

      • Run Time - define at what time to run the periodic scan.

    Note

    To support continuous integration development methodology, it is recommended to schedule periodic scanning of source files so they can be checked after modifications. This can be automated via the CLI in the Build file, but it does not have to be done because SAST scans source code and does not require building or compiling it.

  8. Click <Next> to configure additional advanced options.

    6436170873.png

  9. Configure the following Advanced Action properties:

    • Send pre-scan email to - define to which email address to send a pre-scan notification.

    • Send post-scan email to - define to which email address to send a post-scan notification.

    • Send scan failure email to - define to which email address to send a scan failure notification.

    • Run post-scan action - define which post-scan action to run (see Configuring an Executable Action).

      6455657604.png

      • To set a condition when the post-scan action will run, enable the Run only if the scan has new results with a minimal severity option and select the severity level from the drop-down list. By defining this rule, the post-scan action will be triggered only after a successful scan finds new vulnerabilities that did not appear in the previous successful scan. Note that

      • Optionally, additional arguments to the post-scan action can be specified in the Post scan action arguments field. By having this option, you can set arguments that are project-specific. These arguments can be added to those specified at the post-scan action level.

    • Issue Tracking Settings - define which issue tracking system to integrate (see Configuring JIRA Integration Settings).

    • Parallel Scan Cancellation Mode- define what to do when you queue additional scans of the same project while the previous ones are still in the queue.

      • KeepAll - process all the scans.

      • KeepOld - process the first scan you started and cancel the newer ones.

      • KeepNew - process the newest scan and cancel the previous ones.

      • To apply the selected option to the same code only, select Identical Code Only.

      • To apply the selected option to scans already in process, select Include Scans in Process .

    Note

    The Parallel Scan Cancellation Mode functionality only affects full and public scans.

  10. Click <Next> to define custom fields.

    6436170972.png

  11. Configure the Custom Field properties according to the available custom fields (see Custom Field Management).

  12. Click <Next> to configure data retention.

    6436170975.png

  13. Configure the Data Retention properties:

  14. Click <Finish> and check the scan status (see The Queue).

Scan Path Filter: Including and Excluding Files and Folders

Overview

Previously, you could only specify the exclusion of files and folders. Now, you have more flexibility and can filter files and folders for a specific project's scans by specifying what to include and exclude in your filtering. Inclusion and exclusion using a comma-separated list of Glob/Nant patterns. If the list starts with an exclusion (‘!’), all files will be included and filtered according to the list. If the list starts with an inclusion, no files will be included, and the filter will add files according to the list. Since there will only be one PathFilter input for both files and folders, you must add a ‘/’ at the end of a folder’s name to specify it.

Note

This feature is exclusive to SAST version 9.6.0 and up.

Portal

New Project Page:

6675562672.png

Comma-separated list of Filesets (groups of files) to include/exclude. Wildcards are supported

Example: **/*.class matches all .class files in the directory tree, while !**/*.class excludes those files".

Projects Page (edit):

6688047118.png
In this section: