Fortify & MicroFocus SCA Connector Page

July 30, 2024 16:34

Micro Focus Fortify Static Code Analyzer (SCA) pinpoints the root cause of security vulnerabilities in the source code, prioritizes the most serious issues, and provides detailed guidance on how to fix them so developers can resolve issues in less time with centralized software security management.

From open source component analysis to IDEs, build tools, and developer training, Fortify gives developers the tools to write secure code and optimize application security at every step of the software development cycle.

To import your data from this tool to the Application Security Module module, you will need to use the MicroFocus SCA Connector under the Static Analysis tools section of the .Cisco Vulnerability Management UI.
The Connector is a mandatory full run connector, as it is an XML connector.

What Types of Fortify Data does Cisco Vulnerability Management Support

SCA
OnDemand

This connector is a more generic Fortify / MicroFocus connector. Despite its label as MicroFocus SCA only, it also supports Fortify OnDemand formats.

Prerequisites

You must have the ability to export data (scan reports) from Fortify in XML format.
You must be a Cisco Vulnerability Management administrator.

Configuring your Connector in Cisco Vulnerability Management

1. In the Cisco Vulnerability Management UI, click Connectors.

2. Click Add Connector.

3. In the Static Analysis section, click MicroFocus.

4. On the Fortify page, enter the following information:

Name: Enter a name for the connector, or leave it as .
Asset Inactivity Limit: Enter a time in days for the connector level asset inactivity limit. recommends 2-3 times the scan cadence of your connector scans).

5. Click Save and Verify.

What Fortify / SCA Items does Cisco Vulnerability Management Import?

Cisco Vulnerability Management will import all of the applications associated with the user leveraged for the connector.

Fortify & MicroFocus Field	Cisco Vulnerability Management Field	Notes
build_id	Application identifier	Search for Application identifier in Cisco Vulnerability Management by using the custom query box and typing application:"*"
base_path > filename	File	Search for file in Cisco Vulnerability Management by using the custom query box and typing file:"*"
instance . id	External ID
N/A	Vulnerability Status	Vulnerability status is Open or Closed. We do not map False Positives or Triage States. Open vulnerabilities are reported in application scan reports. Closed vulns are excluded from the report, and Cisco Vulnerability Management autocloses those vulnerabilities.
name	Vulnerability Name
severity	scanner_score
CWE id	CWE
WASC ID	WASC ID
solution	Solution
description	Description
found_on	Found On
file_tags	Tags	These items are turned into Tags in Cisco Vulnerability Management

The Connector does not import the following:

Custom Fields

Optional Settings

The following settings can be enabled on the backend for Fortify / MicroFocus SCA Connectors. To have these settings enabled, or for more information, contact Cisco Support, or your Customer Success Engineer.

Exclude Informationals

When this option is enabled, Cisco Vulnerability Management will not import vulnerabilities that do not include a CVE, CWE, or WASC ID.

Skip Tags

This setting enables you to not create any Tags in Cisco Vulnerability Management based on the scanner metadata.

Ignore Scanner Last Seen Time

If you do not want the asset last seen time in Cisco Vulnerability Management to be the scanner reported last seen time.

Tag Reset

This setting will assist in keeping your scanner metadata in sync with Cisco Vulnerability Management. Each time the connector is run, all tags in Cisco Vulnerability Management will be removed and the scanner tag metadata re-created.

If you have created any manual tags or any tags were created off of metadata from other connectors that tag info will be removed and will be refreshed once those other connectors are rerun.

Custom Ordered Locators

Locators (IP, Netbios, FQDN, etc) can be reordered to better deduplicate vulnerabilities on the Connector level or the entire Platform level. For more information, see the help article here.

Common Reasons for Connector Run Failures

If Cisco Vulnerability Management receives data that is not in the expected format and cannot process it, the connector will fail.
If more than 1% of connector payloads fail to import cleanly, Cisco Vulnerability Management will auto-fail the Connector Run

Additional Assistance

Contact Cisco Support if you require any additional assistance with the Fortify / MicroFocus SCA Connector.