This manual page describes built-in fcli SSC actions that can be run through
the fcli ssc action run <action-name> command.
appversion-summary
(PREVIEW) Generate application version summary.
Synopsis
fcli ssc action run appversion-summary [fcli ssc action run options] [action options, see below]
Description
This action generates a short summary listing issue counts and other statistics for a given application version. Based on user feedback on this initial version of this action, parameters and output of this action may change in the next couple of fcli releases.
Options
- --file, -f
-
Optional output file name (or 'stdout' / 'stderr'). Default value: stdout
- --appversion, --av
-
Required application version id or <appName>:<versionName>
- --filtersets, --fs
-
Comma-separated list of filter set names, guid’s or 'default' to display in the summary. If not specified, all filter sets will be included.
aws-sast-report
Generate a AWS Security Hub SAST report listing Fortify SSC SAST vulnerabilities.
Synopsis
fcli ssc action run aws-sast-report [fcli ssc action run options] [action options, see below]
Description
This action generate a ASFF report to integrate AWS Security Hub, generated reports then parsed by the lambda function, see: https://github.com/fortify/CloudDevSecOpsTemplates/ For information on how to create or update findings into AWS Security Hub, see https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-update-types.html
Options
- --file, -f
-
Optional report output file name (or 'stdout' / 'stderr'). Default value: aws-fortify-report.json
- --appversion, --av
-
Required application version id or <appName>:<versionName>
- --filterset, --fs
-
Filter set name or guid from which to load issue data. Default value: Default filter set for given application version
- --page-size
-
Number of vulnerabilities to retrieve at a time. Higher numbers may reduce time required to build the report, at the cost of increased memory usage (on both fcli and SSC), and could potentially negatively affect overall SSC performance or result in read time-outs (see --socket-timeout option on fcli ssc session login command). Default value: 100
- --aws-region
-
Required AWS region. Default value: AWS_REGION environment variable.
- --aws-account
-
Required AWS account id. Default value: AWS_ACCOUNT_ID environment variable.
bitbucket-sast-report
Generate a BitBucket Code Insights report listing SSC SAST vulnerabilities.
Synopsis
fcli ssc action run bitbucket-sast-report [fcli ssc action run options] [action options, see below]
Description
For information on how to import this report into BitBucket, see https://support.atlassian.com/bitbucket-cloud/docs/code-insights/
Options
- --report-file, -r
-
Optional report output file name (or 'stdout' / 'stderr'). Default value: bb-fortify-report.json
- --annotations-file, -a
-
Optional annotations output file name (or 'stdout' / 'stderr'). Default value: bb-fortify-annotations.json
- --appversion, --av
-
Required application version id or <appName>:<versionName>
- --filterset, --fs
-
Filter set name or guid from which to load issue data. Default value: Default filter set for given application version
- --page-size
-
Number of vulnerabilities to retrieve at a time. Higher numbers may reduce time required to build the report, at the cost of increased memory usage (on both fcli and SSC), and could potentially negatively affect overall SSC performance or result in read time-outs (see --socket-timeout option on fcli ssc session login command). Default value: 100
check-policy
(SAMPLE) Check security policy.
Synopsis
fcli ssc action run check-policy [fcli ssc action run options] [action options, see below]
ci
Run SSC CI pipeline
Synopsis
fcli ssc action run ci [fcli ssc action run options] [action options, see below]
Description
(Work in progress) This action can be used to run a full, standardized CI pipeline that performs the following activities: - Create & configure SSC application version if needed - Package source code - Submit SAST scan request - Wait for SAST scan completion - Perform post-scan activities, like checking policy outcome, exporting results, …
ci-vars
Collect CI-specific data
Synopsis
fcli ssc action run ci-vars [fcli ssc action run options] [action options, see below]
Description
This action collects data used by the SSC & FoD 'ci' actions, based on CI-specific data like CI-specific environment variables. Data is collected in a CI-agnostic global variable named 'ci'. Note that available properties on the global 'ci' variable may change across fcli releases, potentially breaking any custom actions that depend on these properties.
github-pr-comment
(PREVIEW) Add GitHub Pull Request review comments.
Synopsis
fcli ssc action run github-pr-comment [fcli ssc action run options] [action options, see below]
Description
This action adds review comments to a GitHub Pull Request. Currently this is marked as PREVIEW as we build out this functionality; later versions may have different behavior and/or require different action cli.
The current implementation simply compares current scan results against previous scan results in the given SSC application version, listing all new, re-introduced and removed issues in a new PR comment.
For best results, this fcli action should only be run on GitHub pull_request triggers. Upon PR creation, a new SSC application version should be created, copying state from the SSC application version that represents the branch into which the PR will be merged, and a new scan should be run on the current PR branch before invoking this fcli action.
This will ensure that scan results for the current PR will be compared against the latest scan results for the target branch upon PR creation. Optionally, new scans can be run upon PR changes, creating new PR comments that show the issue delta compared to the previous scan for this PR.
Options
- --appversion, --av
-
Required application version id or <appName>:<versionName>
- --filterset, --fs
-
Filter set name or guid from which to load issue data. Default value: Default filter set for given application version
- --analysis-type, -t
-
Analysis type for which to list vulnerabilities. Default value: SCA
- --github-api-url
-
Required GitHub API URL. Default value: GITHUB_API_URL environment variable.
- --github-token
-
Required GitHub Token. Default value: GITHUB_TOKEN environment variable.
- --github-owner
-
Required GitHub repository owner. Default value: GITHUB_REPOSITORY_OWNER environment variable.
- --github-repo
-
Required GitHub repository. Default value: Taken from GITHUB_REPOSITORY environment variable.
- --pr
-
Required PR number. Default value: Taken from GITHUB_REF_NAME environment variable. Note that default value will only work on GitHub pull_request triggers; if this fcli action is invoked through any other GitHub trigger, it will fail unless an explicit PR number is passed through this option.
- --commit
-
Required commit hash. Default value: GITHUB_SHA environment variable.
- --dryrun
-
Set to true to just output PR decoration JSON; don’t actually update any PR
github-sast-report
Generate a GitHub Code Scanning report listing SSC SAST vulnerabilities.
Synopsis
fcli ssc action run github-sast-report [fcli ssc action run options] [action options, see below]
Description
For information on how to import this report into GitHub, see https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github
Options
- --file, -f
-
Optional output file name (or 'stdout' / 'stderr'). Default value: gh-fortify-sast.sarif
- --appversion, --av
-
Required application version id or <appName>:<versionName>
- --filterset, --fs
-
Filter set name or guid from which to load issue data. Default value: Default filter set for given application version
- --page-size
-
Number of vulnerabilities to retrieve at a time. Higher numbers may reduce time required to build the report, at the cost of increased memory usage (on both fcli and SSC), and could potentially negatively affect overall SSC performance or result in read time-outs (see --socket-timeout option on fcli ssc session login command). Default value: 100
gitlab-dast-report
Generate a GitLab DAST report listing SSC DAST vulnerabilities.
Synopsis
fcli ssc action run gitlab-dast-report [fcli ssc action run options] [action options, see below]
Description
For information on how to import this report into GitLab, see https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportsdast
Options
- --file, -f
-
Optional output file name (or 'stdout' / 'stderr'). Default value: gl-fortify-dast.json
- --appversion, --av
-
Required application version id or <appName>:<versionName>
- --filterset, --fs
-
Filter set name or guid from which to load issue data. Default value: Default filter set for given application version
- --page-size
-
Number of vulnerabilities to retrieve at a time. Higher numbers may reduce time required to build the report, at the cost of increased memory usage (on both fcli and SSC), and could potentially negatively affect overall SSC performance or result in read time-outs (see --socket-timeout option on fcli ssc session login command). Default value: 100
gitlab-debricked-report
Generate a GitLab Dependency Scanning report listing SSC Debricked vulnerabilities.
Synopsis
fcli ssc action run gitlab-debricked-report [fcli ssc action run options] [action options, see below]
Description
For information on how to import this report into GitLab, see https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportsdependency_scanning
Options
- --file, -f
-
Optional output file name (or 'stdout' / 'stderr'). Default value: gl-fortify-debricked-depscan.json
- --appversion, --av
-
Required application version id or <appName>:<versionName>
- --filterset, --fs
-
Filter set name or guid from which to load issue data. Default value: Default filter set for given application version
- --page-size
-
Number of vulnerabilities to retrieve at a time. Higher numbers may reduce time required to build the report, at the cost of increased memory usage (on both fcli and SSC), and could potentially negatively affect overall SSC performance or result in read time-outs (see --socket-timeout option on fcli ssc session login command). Default value: 100
gitlab-sast-report
Generate a GitLab SAST report listing SSC SAST vulnerabilities.
Synopsis
fcli ssc action run gitlab-sast-report [fcli ssc action run options] [action options, see below]
Description
For information on how to import this report into GitLab, see https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportssast
Options
- --file, -f
-
Optional output file name (or 'stdout' / 'stderr'). Default value: gl-fortify-sast.json
- --appversion, --av
-
Required application version id or <appName>:<versionName>
- --filterset, --fs
-
Filter set name or guid from which to load issue data. Default value: Default filter set for given application version
- --page-size
-
Number of vulnerabilities to retrieve at a time. Higher numbers may reduce time required to build the report, at the cost of increased memory usage (on both fcli and SSC), and could potentially negatively affect overall SSC performance or result in read time-outs (see --socket-timeout option on fcli ssc session login command). Default value: 100
gitlab-sonatype-report
Generate a GitLab Dependency Scanning report listing SSC Sonatype vulnerabilities.
Synopsis
fcli ssc action run gitlab-sonatype-report [fcli ssc action run options] [action options, see below]
Description
For information on how to import this report into GitLab, see https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportsdependency_scanning
Options
- --file, -f
-
Optional output file name (or 'stdout' / 'stderr'). Default value: gl-fortify-sonatype-depscan.json
- --appversion, --av
-
Required application version id or <appName>:<versionName>
- --filterset, --fs
-
Filter set name or guid from which to load issue data. Default value: Default filter set for given application version
- --page-size
-
Number of vulnerabilities to retrieve at a time. Higher numbers may reduce time required to build the report, at the cost of increased memory usage (on both fcli and SSC), and could potentially negatively affect overall SSC performance or result in read time-outs (see --socket-timeout option on fcli ssc session login command). Default value: 100
package
Package source code
Synopsis
fcli ssc action run package [fcli ssc action run options] [action options, see below]
Options
- --sc-client-version, -v
-
Specify the ScanCentral Client version to be used for packaging. Defaults to the value of the SC_CLIENT_VERSION environment variable, or 'latest' if not specified.
- --source-dir, -d
-
Specify the source directory to be packaged. Defaults to the value of the SOURCE_DIR environment variable, or current working directory if not specified.
- --debug
-
Add the -debug flag to the ScanCentral Client command. Defaults to the value of the DO_PACKAGE_DEBUG environment variable, or false if not specified.
- --tool-definitions
-
Custom tool definitions to use for identifying available ScanCentral Client versions and download URLs. Defaults to the value of the TOOL_DEFINITIONS environment variable, or the built-in default if not specified.
- --extra-opts
-
Extra options to be passed to the 'scancentral package' command. Defaults to the options specified in the EXTRA_PACKAGE_OPTS environment variable, or no extra options if not specified.
- --output, -o
-
Name of the zip file in which packaged source code should be stored. Defaults to package.zip in the current working directory.
- --use-package
-
Use an existing package file instead of trying to package the given source code directory. If specified, this ignores all other options.
sarif-sast-report
Generate SARIF report listing SSC SAST vulnerabilities.
Synopsis
fcli ssc action run sarif-sast-report [fcli ssc action run options] [action options, see below]
Description
This action generates a SARIF report listing Fortify SAST vulnerabilities, which may be useful for integration with various 3rd-party tools that can ingest SARIF reports. For more information about SARIF, please see https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html
Options
- --file, -f
-
Optional output file name (or 'stdout' / 'stderr'). Default value: fortify-sast.sarif
- --appversion, --av
-
Required application version id or <appName>:<versionName>
- --filterset, --fs
-
Filter set name or guid from which to load issue data. Default value: Default filter set for given application version
- --page-size
-
Number of vulnerabilities to retrieve at a time. Higher numbers may reduce time required to build the report, at the cost of increased memory usage (on both fcli and SSC), and could potentially negatively affect overall SSC performance or result in read time-outs (see --socket-timeout option on fcli ssc session login command). Default value: 100
setup-appversion
Set up application version.
Synopsis
fcli ssc action run setup-appversion [fcli ssc action run options] [action options, see below]
Description
This action allows for preparing an application version for running an application security scan, creating the application and/or release if they do not exist yet.
Although the same functionality can be achieved by manually running the
fcli ssc appversion create command, this action provides a convenient and
standardized approach for running this command with some default options like
--skip-if-exists and --auto-required-attrs.
To provide even more consistency across CI/CD pipelines in your organization, it is recommended to implement one or more custom setup actions that provide suitable default values or even hard-coded, non-overridable values for the various options, for example based on business unit, team, and/or application type. Such custom actions could for example set standard application version attributes for a particular type of application to be scanned. Alternative to implementing multiple custom actions, you may also consider implementing a single custom action that takes for example a --profile option to select between different profiles that each define appropriate option values and setup commands to run.
sonarqube-sast-report
Generate a SonarQube External Issues report listing SSC SAST vulnerabilities.
Synopsis
fcli ssc action run sonarqube-sast-report [fcli ssc action run options] [action options, see below]
Description
For information on how to import this report into SonarQube, see https://docs.sonarsource.com/sonarqube/latest/analyzing-source-code/importing-external-issues/external-analyzer-reports/
Options
- --file, -f
-
Optional output file name (or 'stdout' / 'stderr'). Default value: sq-fortify-sast.json
- --file-path-prefix, --pfx
-
Optional prefix for issue file paths
- --appversion, --av
-
Required application version id or <appName>:<versionName>
- --filterset, --fs
-
Optional filter set name or guid from which to load issue data. Default value: Default filter set for given application version
- --page-size
-
Number of vulnerabilities to retrieve at a time. Higher numbers may reduce time required to build the report, at the cost of increased memory usage (on both fcli and SSC), and could potentially negatively affect overall SSC performance or result in read time-outs (see --socket-timeout option on fcli ssc session login command). Default value: 100
test-sessions
Test shared sessions
Synopsis
fcli ssc action run test-sessions [fcli ssc action run options] [action options, see below]