How to diff Fortify SCA scans

问题:

We have Fortify SCA and we are setting up regular, automated scans of our source code. Our intention is to have an alert if there is an introduced security issue. Is there a way, perhaps using FPRUtility (or some other method) to accomplish this? Ultimately I prefer something that can be easily run from the command line, but if this can also be accomplished using the GUI then I would appreciate knowing how to do that as well.

回答1:

1. Use Audit Workbench to run a report. Choose "developer workbook" and disable all except one section. (you can choose any section you want).

2. In the report section's additional properties, set the filter for the issues to [issue age]:new. This means the report will show ONLY issues in your FPR that were not present in the previous scan, and were introduced in the latest scan. Save the template.

3. In your scan configuration, make sure to scan to the same FPR every time per project, so that "new" issues can be calculated by the report runner.

4. After the scan is complete, use the answer by @user1836982 to run the report. Choose the XML template and process it programmatically.

回答2:

(1) Command for the Fortify report generation to XML FORMAT: FORTIFY_INSTALL_DIR\bin\ReportGenerator.bat -format xml -f target_file_name.xml -source your_fpr_file_name.fpr -template Detailed-DefaultReportDefinition.xml

(2) you can also use AWB to generate the .pdf/.rtf/.xml report by Report(top menu bar) -> save report -> select format ->save

(3) Just added procedure to create excel sheet here: Export HP Fortify SCA 4.10 results in EXCEL format

(4) If you have access to DB (oracle), you can query with script

回答3:

If you are using Fortify SCA, you should also have access to Fortify Software Security Center (SSC). SSC can be used to track trending data across builds of a project. SSC has built in capabilities to send out alerts based on user-defined events within SSC; I have never worked with those so can't offer any thoughts other than what the docs say.

The reports generated by Fortify SCA (.fpr files) are zip files XML documents storing all the relevant data; I would suspect some of the data in those files are related to the SCA rulesets that are present in both SCA and SSC instances. I suspect without the rulesets you would be able to determine that new issues have been introduced, but not any good data on what they are, priority level, etc.