Synopsis
fcli aviator ssc correlate-sast-dast [--[no-]refresh] [--app=<appName>] --av=<appVersionNameOrId> [--delim=<delimiter>] [--progress=<type>] [--refresh-timeout=<timeoutPeriod>] [[-h] [--env-prefix=<prefix>] [--log-file=<logFile>] [--log-level=<logLevel>] [--log-mask=<level>] [--debug]] [[--ssc-session=<sessionName>]] [[-o=<type+args>] [--style*=<style>,…]… ] [--to-file=<outputFile>_]] [[--av-session=<sessionName>]]
Description
Downloads the latest SAST and DAST FPR artifacts from an SSC application version, groups findings by category, streams mixed-category SAST findings to the Fortify Aviator server for correlation via gRPC, injects correlation results into the DAST FPR as ExternalFindings, and uploads it back to SSC. Required option: --av.
Examples:
Correlate the latest SAST and DAST results of an application version: fcli aviator ssc correlate-sast-dast --av "MyApp:1.0"
Correlate using a specific Fortify Aviator application: fcli aviator ssc correlate-sast-dast --av "MyApp:1.0" --app MyAviatorApp
Correlate without refreshing application version metrics first: fcli aviator ssc correlate-sast-dast --av "MyApp:1.0" --no-refresh
Options
- --app=<appName>
-
Fortify Aviator application name to associate with the correlation. If not provided, the SAST/FPR Build ID of the SSC application is used.
- --av, --appversion=<appVersionNameOrId>
-
Application version id or <application>:<version> name.
- --delim=<delimiter>
-
Change the default delimiter character when using options that accept "application:version" as an argument or parameter.
- --progress=<type>
-
Configure progress output. Allowed values: auto, none, simple, stderr, single-line, ansi. Default value: auto. Proper output of single-line and ansi depends on console capabilities.
- --[no-]refresh
-
Refresh out-of-date application version metrics before downloading the FPR. Note that for large applications this can lead to an error if the timeout expires.
- --refresh-timeout=<timeoutPeriod>
-
Time-out for refreshing application version metrics, for example 30s (30 seconds), 5m (5 minutes), 1h (1 hour). Default value: 60s
SSC session name options
- --ssc-session=<sessionName>
-
Name of the SSC session to use for executing this command. Default value: default.
Aviator user session name options
- --av-session, --aviator-session=<sessionName>
-
Name of the Aviator user session to use for executing this command. Default value: default.
Output options (also see documentation link below)
- -o, --output=<type+args>
-
Select output type (csv, table, expr, json, xml, yaml) and optional type arguments.
- --store=<var>[:<prop>]
-
Store JSON results in an fcli variable for later reference.
- *--style*=<style>,…
-
Select output style: header, no-header, pretty, no-pretty, flat, no-flat, array, single, border, no-border, md-border, wrap, no-wrap, fast-output, no-fast-output, envelope, no-envelope, csv-escape, no-csv-escape.
- --to-file=<outputFile>
-
Write output to the specified file.
Generic fcli options (also see documentation link below)
- --debug
-
Enable collection of debug logs.
- --env-prefix=<prefix>
-
Prefix for resolving default option values. Default value: FCLI_DEFAULT.
- -h, --help
-
Use 'fcli [command] -h' to display help for fcli (sub-)commands.
- --log-file=<logFile>
-
Write log output to file. Default: ./fcli.log if logging is enabled.
- --log-level=<logLevel>
-
Set logging level: TRACE, DEBUG, INFO, WARN, ERROR, NONE.
- --log-mask=<level>
-
Log mask level: high, medium, low, none. Default: medium. Masking is done on a best-effort basis; no guarantee that all sensitive data will be masked.