Tool Service Configuration

This section allows you to manage a list of certificates that tool orchestration components should trust.

The Manage Certificates section lets a tool or the Tool Orchestration Service handle applications that use a self-signed certificate or a certificate issued by a certificate authority that is not well-known. Click Add Certificate and specify a certificate file to update the list. You will see your certificate in the list after an upload completes. Software Risk Manager will give you the option to overwrite an existing certificate file or cancel your upload if you choose a file that is already in the list. The upload time will appear in the list under each certificate filename to help you manage your certificates.

Deleting a certificate removes it from the list and prevents future access by tool orchestration components. However, removing a certificate will not remove the certificate from any in-progress orchestration-related activity.

This section allows you to manage data that you can share with one or more tool orchestration components that may require account credentials, keys, or other types of sensitive data.

Click Add New Secret to start generating data for your secret. Specify a name, and click OK to define your list of fields.

To add a field, click Add Field. To add a sensitive field, click Add Sensitive Field. Specify a name for the field, and click OK.

With sensitive data entry, your value is masked as you type, and you must confirm the correct value by entering it twice. Also, sensitive values are write-only and cannot be retrieved from the API of the Tool Orchestration Service. When you have finished specifying fields and field values, click Save to store your secret.

Project secrets get stored as Kubernetes Secrets, so it's recommended that you follow the Kubernetes guidance on encrypting secret data at rest (https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).

You can edit field values at any time. Project secrets support limited editing: you cannot change a secret's name, add or remove fields, or change the data entry mode for a field value.

Project secrets are meant to be used with add-in tools, so Software Risk Manager will display a warning icon to highlight those that are not yet assigned to a tool. You can learn about assigning secrets to tools in the Customize Add-In Tools section below.

This section lets you customize tools that you previously registered on the Add-In Tool page. Software Risk Manager shows your list of registered tools on the left, and you can select a tool to enable/disable it, assign one or more project secrets, or adjust tool behavior by changing any custom TOML configuration data the tool can read.

What you can customize will vary by tool. For example, the default Security Code Scan tool has no project-specific TOML configuration, and it does not read project secrets, but the Enabled/Disabled toggle lets you customize whether it is available for your project.

Alternatively, the ZAP tool allows you to use project secrets to make authenticated requests during scanning. The interpretation of project secret data is tool dependent—ZAP, for example, will ignore any secrets with missing username or password fields.

The Config box shows any project-specific TOML configuration for the tool you selected.

You should avoid using the Default enabled feature for tools with project-specific TOML configuration unless you have a process for specifying project configuration before a tool runs. Tools with insufficient configuration details typically fail when run.

Remember to click Save to keep changes, and you must save any changes you want to keep before selecting another tool.

[checkmarx]
baseUrl = ""
projectId = 0
                        
[scan]
checkScanStatusDelay = 60

[context]
target = ""
                        
[scanOptions]
runActiveScan = false
                        
[reportOptions]
minRiskThreshold = 0
minConfThreshold = 0
                        
[authentication]
type = "none"
loginIndicatorRegex = ""
                        
[formAuthentication]
formURL = ""
formUsernameFieldName = ""
formPasswordFieldName = ""
formAntiCrossSiteRequestForgeryFieldName = ""
formExtraPostData = ""
                        
[scriptAuthentication]
authenticationScriptContent = ""