SecureAssist Enterprise Portal User Guide June 2018

Transcription

1 SecureAssist Enterprise Portal User Guide June 2018

2 Copyright 2018 by Synopsys, Inc. All rights reserved worldwide. No part or parts of this documentation may be reproduced, translated, stored in any electronic retrieval system, transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without prior written permission of the copyright owner. Synopsys retains the exclusive title to all intellectual property rights relating to this documentation. The information in this documentation is subject to change without notice and should not be construed as a commitment by Synopsys. Synopsys makes no representations or warranties, express or implied, with respect to the documentation and shall not be liable for any damages, including any indirect, incidental, consequential damages (such as loss of profit, loss of use of assets, loss of business opportunity, loss of data, or claims for or on behalf of user s customers) that may be suffered by the user. Synopsys and the Synopsys logo are trademarks of Synopsys. Other brands and products are trademarks of their respective owner(s). Synopsys, Inc. 690 E. Middlefield Road Mountain View, CA Phone: +1 (650)

3 Table of Contents SecureAssist Enterprise Portal Setup...1 Installation...1 Database Setup...1 Initial Configuration...8 Set Up JavaScript Analysis Binaries...8 Upgrade Instructions License Renewal Log in to SecureAssist Getting Started Portal Navigation Statistics Project Statistics User Statistics Timeseries Reports Project Reports User Reports Rulepacks Manage Portal Users Plugin Users Plugin User Groups Roles Account Settings LDAP Configuration Feature Configuration More Support About Us Appendix A: Roles and Associated Permissions Appendix B: Permission Descriptions Appendix C: Audit Log Appendix D: API Functionality Authentication Generate Project Report Get Project List Number of Active Developers Number of Projects Scanned Number of Project Defects Top Number of Findings Most Viewed Guidance... 74

4 June 2018 Page 1 of 76 SecureAssist Enterprise Portal Setup The SecureAssist Enterprise Portal is a centralized portal that allows organizations to manage SecureAssist plugin licenses, rulepacks, and tool settings. It also provides centralized reporting on security vulnerabilities found by users and how those change over time. Installation This section describes the installation of the SecureAssist Enterprise Portal and SecureAssist Eclipse update site. The Portal and update site can be deployed on the same application server, or they can be deployed on separate servers. This document assumes that they are installed on the same server. Database Setup Configure Main Database Connection The database will handle registration, activation, rulepack requests etc. The following image displays the Database Connection screen.

5 June 2018 Page 2 of 76 Configure Database Database Instructions MySQL Oracle Configure MySQL Database and User 1. Run the mysql command from the command prompt as a MySQL super user: mysql -u root -p 2. Create an empty CSA Portal database schema. Replace portal_csa with a database name of your choice: CREATE DATABASE portal_csa; 3. Create CSA Portal database user: GRANT ALL PRIVILEGES ON portal_csa.* TO localhost IDENTIFIED BY csauserpassword ; Optional: Replace portal_csa with the name of the database that you have created in the step above. Additionally, replace csauser and csauserpassword with the username and password of your choice. If the SecureAssist Enterprise Portal is not running on the same server as your MySQL database server, replace localhost with the hostname or IP address of the SecureAssist server. Importing Schema into the Database 1. To import schema into portal database run the following commands. Assume portal database is created with name portal_csa mysql -u root -p portal_csa < portal_csa_mysql.sql mysql -u root -p portal_csa < portal_csa_mysql_aggregation.sql Note: In the case of running the above commands from a different directory, the absolute path of schema files should be provided. Note: The upgrade scripts may delete some records from the existing database. Ensure the Safe-Update option is turned off. This is done by running the command: SET SQL_SAFE_UPDATES = 0; Configure Database and User (Oracle 12c Only) 1. Open sqlplus `sqlplus / as sysdba` and run these steps from there. (If you would like to use a different schema identifier than portal_csa, replace portal_csa with your custom schema name in the database scripts as well as in the commands below.) 2. CONNECT system/manager AS sysdba; 3. ALTER SESSION SET "_oracle_script"=true 4. CREATE USER portal_csa IDENTIFIED BY Passw0rd DEFAULT TABLESPACE USERS TEMPORARY TABLESPACE TEMP; 5. GRANT CREATE SESSION, RESOURCE, CREATE VIEW, CREATE MATERIALIZED VIEW, CREATE SYNONYM TO portal_csa; 6. ALTER USER portal_csa QUOTA UNLIMITED ON USERS; Configure Database and User (all versions EXCEPT Oracle 12c) 1. To modify database name, user, and password (password change is required), modify the Oracle SQL script located at <CSA_Portal_Package>/db/portal_csa_oracle.sql. (Please make sure to modify this script with desired username and password prior to running the database import process.) 2. To modify credentials of user that will be used to connect to CSA Portal database, modify following line in the SQL Script: CREATE USER portal_csa IDENTIFIED BY Passw0rd DEFAULT TABLESPACE USERS TEMPORARY TABLESPACE TEMP;

6 June 2018 Page 3 of 76 Database Instructions Optional: Replace portal_csa and Passw0rd with username and password of your choice. Make sure to update all following lines with updated information: connect portal_csa/passw0rd; Running SQL Database Import Script 1. Log in to SQL*Plus as sysdba using following command: sqlplus /as sysdba 2. To log output of SQL script execution, turn on spool: spool /<path>/<to>/log.txt ; 3. Execute SQL 4. Execute SQL 5. Turn off spool: spool off; 6. Exit from SQL*Plus: exit; 7. Review log file with SQL script execution output to validate that there are no errors. Configure Secure HTTP SecureAssist Enterprise Portal supports HTTP and Secure HTTP (HTTPS). Synopsys strongly recommends using HTTPS. For information on configuring the Apache Tomcat web server to use HTTPS, refer to your web server s documentation. Prior to installation or upgrading, Synopsys recommends configuring a minimum heap size of 1 GB. Deploy SecureAssist Portal These instructions are for Apache Tomcat application server to set the minimum and maximum heap size to 1024 MB. Command-Line Tomcat Instance 1. Create a file named "setenv.bat" or "setenv.sh" in the <CATALINA_HOME>/bin folder and set the CATALINA_OPTS to the memory settings. a. On Windows: "set CATALINA_OPTS='-Xms1024 Xmx1024m -Xss1024k -XX:PermSize=256m - XX:MaxPermSize=512m -XX:+UseConcMarkSweepGC - XX:+CMSClassUnloadingEnabled'" b. On Linux: "export CATALINA_OPTS='-Xms1024m Xmx1024m -Xss1024k -XX:PermSize=256m - XX:MaxPermSize=512m -XX:+UseConcMarkSweepGC - XX:+CMSClassUnloadingEnabled'" Windows Service Tomcat Instance 1. Execute Tomcat<version#>w.exe in the %CATALINA_HOME%\bin\ directory and enter 1024 in the Initial memory pool and Maximum memory pool fields.

7 June 2018 Page 4 of 76 Deploy Using Tomcat Manager If Tomcat is running in the Tomcat Web Application Manager, you can use its browser interface to deploy the Portal. 1. In %CATALINA_HOME%/conf/tomcat_users.xml, create a role named manager-gui and assign a user to this role. Restart Tomcat instance to make the changes affected. <tomcat-users><role rolename= manager-gui /><user username= USERNAME password= PASSWORD roles= manager-gui /></tomcat-users> 2. In your internet browser, navigate to the Tomcat home page (by default located at 3. Click on the Manager App link. You will be asked to enter your username and password (from step 1, above). 4. Enter your username and password. The Web Application Manager page will load.

8 June 2018 Page 5 of Navigate to the WAR file to deploy section and click Browse. 6. Select the CSA Portal web application WAR file, click Open, then click Deploy. After Tomcat has finished deploying the Portal, it is listed in the Applications section and ready to use.

9 June 2018 Page 6 of 76 Deploy on a Running Tomcat Server To deploy the SecureAssist Enterprise Portal on a running Tomcat server, follow these steps. 1. Set the autodeployattribute to true in your server.xml file inside Tomcat s conf directory. The host will deploy the web application when the WAR file is copied to the deployment directory. The default deployment directory is %CATALINA_HOME%/webapps. 2. To deploy the Portal, copy CSA_Server.war file to %CATALINA_HOME%/webapps. Deploy Using WebSphere To deploy the SecureAssist Enterprise Portal on a WebSphere (8.5.X) application server, follow these instructions. (Prior to the application deployment, we recommend setting the heap space to at least 1 GB.) 1. Increase Heap Space. a. Start the WebSphere Application Server administrative console. b. Navigate to Servers > Application servers > server1 > Java and Process Management > Process Definition > Java Virtual Machine. c. Set the initial and maximum heap size to at least 1024 MB. d. Click Apply. e. Click OK. f. Click Save Save directly to the master configuration. g. Restart WebSphere. 2. Deploy SecureAssist Enterprise Portal EAR File. a. Start the WebSphere Application Server administrative console. b. On the navigation menu on the left side of the screen, select Global Deployment Settings from the Applications section. c. Check the Monitor directory to automatically deploy applications checkbox. d. Click Apply. e. Click Save "Save directly to the master configuration." f. Restart WebSphere. g. After WebSphere restarts, copy the EAR file to WebSphere/AppServer/profiles/AppSrv04/monitoredDep loyableapps/servers/server1. h. After several minutes, start the WebSphere Application Server administrative console. i. To verify the application has been deployed and is running, select Applications > Applications Types > WebSphere enterprise applications from the navigation menu. j. Navigate to (e.g Optional. Import SSL certificate to support Secure LDAP.

10 June 2018 Page 7 of 76 a. Start the WebSphere Application Server administrative console. b. On the navigation menu on the left side of the screen, select SSL certificate and key management from the Security section. c. In the Related Items section, click Key stores and certificates. d. Select NodeDefaultKeyStore and in the Additional Properties section click Signer Certificates. e. In the Signer Certificate table, click Retrieve from Port. f. Provide you LDAPS server host name, port, and alias for the key, then click Retrieve signer information. g. Click OK. h. Click Save "Save directly to the master configuration." i. Navigate back to Key stores and certificates and repeat steps (d) through (h) for NodeDefaultTrustStore. j. Restart Websphere. Install MySQL Database Connector The MySQL Connector/J (official JDBC driver for MySQL database) is required to connect the SecureAssist Enterprise Portal to a MySQL database. This step is not necessary when using an Oracle database. To install the MySQL connector, follow these steps. 1. Navigate to and download MySQL Connector/J. 2. Extract mysql-connector-java-5.x.x-bin.jar file from the archive downloaded in previous step and copy it into the /CSA_Server/WEB-INF/lib directory. Deploy SecureAssist Eclipse Update Site To deploy the SecureAssist Eclipse update site local to the portal, simply copy the /update directory from the Eclipse plugin installation package and place it right next to your CSA_Server folder. To deploy it to a server remote to the Enterprise Portal, simply ensure the update directory is accessible via HTTP or HTTPS. To configure the portal to display the update site URL, modify the value of the eclipseupdateurl to the update site URL and the value of the eclipseupdatetext to how you would like the link to be displayed. This should be done in the index.jsp and login.jsp files in the WEB_INF/jsp/includes directory of your SecureAssist deployment. The server will need to be restarted for the change to take effect. Important! When deploying the update site local to the portal, place the /update folder next to the CSA_Server directory, NOT inside it.

11 June 2018 Page 8 of 76 Initial Configuration Configure Logging The Log4j configuration file is stored at /CSA_Server/WEBINF/classes/log4j2.xml file. You can edit this file to make it suitable for the deployment environment. In the log4j2.xml there are two configurable log4j appenders that can be customized by the portal administrator: Appender file : A general purpose log. By default appends to CSA_PORTAL.log. Appender audit : A log for auditing portal user activity. By default appends to CSA_PORTAL_AUDIT.csv. (See Appendix C for details.) For more information about configuring log4j, refer to the log4j documentation. Note: Any changes made to the logging configuration file will take effect only after restarting the Tomcat Application Server or WebSphere Application Server. Set Up JavaScript Analysis Binaries JavaScript analysis support requires a separate license from the main SecureAssist license that is required to use the Portal. Reach out to secureassist-support@synopsys.com to obtain a license for JavaScript analysis. At this time, JavaScript analysis is supported only for the SecureAssist Eclipse plugin and not for Visual Studio or IntelliJ plugins. After successful deployment of the SecureAssist Enterprise Portal, follow these steps to set up JavaScript analysis. 1. Download the JavaScript Analysis binary(ies) and place them at <CSA_Server_home>/jsa/<os>/x64/. JavaScript analysis is dependent on the operating system on the developer s machine where Eclipse IDE is installed and Windows, Mac, and Linux are supported. Only 64 bit architecture is supported for JavaScript analysis. If, for example, developers in your enterprise do not use Mac OS, then you can skip placing binary for Mac. 2. Copy the JavaScript analysis license file to <CSA_Server_home>/jsa/ as license.dat. 3. Restart your webserver.

12 June 2018 Page 9 of 76 The directory structure of <CSA_Server_home>/jsa would look like this: -- jsa -- windows -- x64 -- linux -- mac -- x64 -- x64 -- license.dat -- binary.zip -- binary.zip -- binary.zip The Help file for each operating system is kept under its respective directory. Initial Configuration After the successful deployment of the SecureAssist Enterprise Portal, open your browser and navigate to to finish the configuration of the portal. The following table describes the items that you need to configure. Item Description License Terms Read terms and conditions and click I Agree to continue. Product License Database Setup Please reach out to SecureAssist support at secureassistsupport@synopsys.com to obtain SecureAssist license file. After receiving the server license file, click Browse and select server license file, then click Upload on the license activation/upload screen during the Enterprise Portal setup. Before setting up the database connection, you must set up the database schema and create a database user as described in the Configure Database section above. Complete all fields and click Save. Examples: Database Type: MySQL Production Database Server: jdbc:mysql://<db_server>:3306 Database/Schema Name: portal_csa Database User: csauser

13 June 2018 Page 10 of 76 Item Description Administrator Account Setup In the last step of the initial configuration, the administrator account must be created. Select either LDAP User or Local User in Administrator Type and then complete the appropriate fields: Local User. Enter Username, Password, and Password Confirmation, then click Save. LDAP User. Enter Authentication & Security settings, Server settings, LDAP Login settings, and administrator credentials (Username, Password, and Password Confirmation), then click Save. You can also setup LDAP authentication after the completed setup as well. If LDAP is set up, you can disable your original local user account. Upon successful initial configuration, you will be redirected to the Index page and can log in using the administrator credentials you created. Configure Link on Index Page (Optional) The Index page contains a section with the link to the location from where the SecureAssist Eclipse IDE plugin can be installed or updated. Additionally, you can have separate links for IntelliJ and Visual Studio, but this is not required. To configure the link, navigate to /CSA_Server/WEB-INF/jsp/includes/. Open file index.jsp and edit the following line so that the value equals the correct URL from which the plugin can be installed. If you do not want the link to be displayed, leave the value as empty.

14 June 2018 Page 11 of 76 Upgrade Instructions This section explains the instructions for upgrading the SecureAssist Enterprise Portal from your current version to the latest one. Please go through the following sections for database and server upgrade instructions. Both the application server and database components must be upgraded for proper Portal function. Note: SecureAssist 3.3 adds JavaScript analysis support. The JavaScript analysis support requires a separate license; reach out to secureassist-support@synopsys.com to obtain one. Once you obtain this separate license, refer to Set Up JavaScript Analysis Binaries above for how to set up JavaScript analysis. If you are upgrading from a version older than 2.5, reach out to secureassist-support@synopsys.com to get a new license file. Application Upgrade Follow these instructions to upgrade the Portal. Important! It is critical to stop your Apache Tomcat or WebSphere Application Server prior to your database upgrade. Tomcat Application Server 1. Stop Apache Tomcat service. 2. Backup following directories/files: a. From %CATALINA_HOME%/webapps/CSA_Server folder, - key-file - stats - rulepacks - %CATALINA_HOME%/webapps/CSA_Server/WEB- INF/lib/mysql-connector-java-5.x.x.jar b. From %CATALINA_HOME%/webapps/CSA_Server/WEB- INF/ folder, - cron.properties - db.properties - <company_name>-secureassist-prikey.der - SecureAssist.license - classes/log4j2.xml (optional, see step 9) 3. Delete CSA_Server.war file and CSA_Server folder from %CATALINA_HOME%/webapps. 4. Copy the latest CSA_Server.war file to %CATALINA_HOME%/webapps folder for server deployment, or deploy.war file from Tomcat Manager. 5. Upgrade database by following instructions in the Database Upgrade section below. 6. Start Apache Tomcat. 7. Restore the backup files/folders taken during step-2 to their respective folders. 8. Ensure that all directories and files copied from the backup folder are readable and writable by a user running Tomcat (e.g., chown tomcat:tomcat path/to/file).

15 June 2018 Page 12 of Only if you are using MySQL: Copy MySQL Connector (mysqlconnector-java-5.x.x.jar) to %CATALINA_HOME%/webapps/CSA_Server/WEB-INF/lib/. Websphere Application Server 1. Stop WebSphere Application Server (WAS). 2. Create backup directory. 3. Backup following directories/files: a. Copy following directories and files to backup folder: - /CSA_Server/key-file - /CSA_Server/stats - /CSA_Server/rulepacks - /CSA_Server/WEB-INF/lib/mysql-connector-java-5.x.x.jar b. Copy following files from /CSA_Server/WEB-INF/ folder to backup folder: - cron.properties - db.properties - <company_name>-secureassist-prikey.der - SecureAssist.license - classes/log4j2.xml (optional, see step 9) c. Make a backup of complete JSA folder 4. Delete CSA_Server.EAR file and CSA_Server folder from WAS Server1 folder. 5. Copy new CSA_Server.EAR file to WAS Server1 folder for server deployment. 6. Upgrade database by following instructions in the Database Upgrade section below. 7. Start WebSphere Application Server (WAS), new CSA_Server.EAR file is deployed on restart. 8. Restore the backup files back to their respective folders. a. Copy back the jsa folder to CSA_Server folder b. Update the binaries if needed. 9. Only if you are using MySQL: Copy MySQL Connector (mysqlconnector-java-5.x.x.jar) to /CSA_Server/WEB-INF/lib/. 10. Restart WebSphere Application Server (WAS). Upgrading JavaScript Analysis Binaries or License To upgrade to the latest available binaries, simply follow the steps to set up JavaScript analysis binaries under Initial Configuration in this guide. Database Upgrade If your current Portal version is or later, upgrading the database to the latest version requires just one script execution. If your current Portal version is earlier than 2.5.1, you must first upgrade to version 2.5.1, and then follow the instructions for upgrading to the latest version. Upgrading from Version or Later to Current For the upgrade it is assumed that you are in the <Enterprise Portal archive>/db directory. These are features of the script:

16 June 2018 Page 13 of 76 Backs up the current database before upgrading it. If the backup fails, upgrade is aborted.. Supports upgrade of MySQL and Oracle databases on Windows and Linux. Upgrades main as well as reporting database (if one exists). Does NOT roll back changes if the upgrade fails. Backups are made before upgrade. Prerequisites 1. The script should be run locally on the database server; hence, access to the database server is required. 2. JRE 7 or later is required to run the script. 3. SYSDBA permission is required for Oracle database. 4. Java database drivers are required -- that is, MySQL connector jar (mysql-connector-java-*.jar) for MySQL and Oracle connector jar (ojdbc*.jar) for Oracle. The driver jar should be placed under the db/drivers directory. 5. Mysqldump (used to back up MySQL database) or expdp (used to back up Oracle) should be on PATH. 6. For Microsoft Windows, permission to execute powershell scripts is required. To execute the powershell script, execution policy must be set to allow unsigned scripts. Execute the following command by running powershell as an administrator: Set-ExecutionPolicy RemoteSigned 7. A directory object reference must be created to back up the Oracle database. The following command creates the directory reference. CONN / AS SYSDBA ALTER USER <csa database username> IDENTIFIED BY <Password> ACCOUNT UNLOCK; CREATE OR REPLACE DIRECTORY backups AS '<full path to directory where backup should be kept>'; GRANT READ, WRITE ON DIRECTORY backups TO <csa database username>; Upgrade Settings File(s) For linux linux_settings.sh, and for windows windows_settings.ps1 are used for upgrade process. In the windows_settings.ps1 file, all the values should be enclosed in double quotes. Below is an example for MySQL on Linux.

17 June 2018 Page 14 of 76 # MYSQL or ORACLE DATABASE=MYSQL # Main database CSA_PORTAL_SCHEMA=portal_csa DB_USER=root DB_HOST=localhost DB_PORT=3306 # Below four settings are required only if aggregation tables (issue_agg, file_scan_agg) are on a separate instance than the main instance CSA_PORTAL_SCHEMA_AGG= DBAGG_USER= Running the Upgrade Script Once all the prerequisites are satisfied and settings are included, the upgrade script can be run. Database Instructions Linux 1. On the Linux shell, navigate to the db directory. 2. Make linux_install.sh and linux_settings.sh file executable using the chmod command. 3. Execute the linux_install.sh script to upgrade the database to the latest version. Windows 1. On the Windows power shell, navigate to the db directory. 2. Ensure execution policy has been set to RemoteSigned, as mentioned in Prerequisites above. 3. Execute windows_install.ps1 to upgrade the database to the latest version. Upgrading from Older Version to Depending on your current version of SecureAssist Portal, a few upgrade scripts may need to be run to upgrade to version The following table shows which scripts you will need to run. Upgrade scripts can be found at the <Enterprise Portal archive/db/upgrade/> directory.

18 June 2018 Page 15 of 76 Versions Upgrade Paths to Run the following script: 2.4.1_to_ to Run the following script: 2.4.1_to_ to Run these scripts in the following order: 2.4.0_to_ _to_ , or to Run these scripts in the following order: 2.3.7_to_ _to_ _to_ to Run these scripts in the following order: 2.3.6_to_ _to_ _to_ _to_ to Run these scripts in the following order: 2.3.1_to_ to _to_ _to_ _to_ to Run these scripts in the following order: 2.3_to_ _to _to_ _to_ _to_ _to_ to Run these scripts in the following order: 2.2_to_2.3.1, 2.3.1_to_ _to_ _to_ _to_ _to_2.5.1

19 June 2018 Page 16 of 76 Knowing which scripts to run, follow these instructions to upgrade your database to 2.5.1: Database Instructions MySQL Oracle Run the following commands for database upgrade. Production Database is portal_csa mysql -u root -p portal_csa < path_to/upgrade/{from_to_versions}/mysql_upgrade_{version}_to_{v ersion}.sql mysql -u root -p portal_csa < /portal_csa_mysql_aggregation.sql Configure Database and User 1. To modify database name, user, and password (password change is required), modify the Oracle specific SQL script located in <CSA_Portal_Package>/db/portal_csa_oracle.sql. (Please make sure to modify this script with desired username and password prior to running the database import process.) 2. In order to modify credentials of user that will be used to connect to CSA Portal database, modify following line in the SQL Script: CREATE USER portal_csa IDENTIFIED BY Passw0rd DEFAULT TABLESPACE USERS TEMPORARY TABLESPACE TEMP; Optional: Replace portal_csa and Passw0rd with username and password of your choice. Make sure to update all following lines with updated information: connect portal_csa/passw0rd; Running SQL Database Import Script 1. Log in to SQL*Plus as sysdba using following command: sqlplus /as sysdba 2. To log output of SQL script execution, turn on spool: spool /<path>/<to>/log.txt ; 3. Execute SQL 4. When converting from database version EARLIER than 2.5.0, execute SQL 5. Turn off spool: spool off; 6. Exit from SQL*Plus: exit; 7. Review log file with SQL script execution output to validate that there are no errors. License Renewal Follow these instructions to renew your SecureAssist Enterprise Portal license. As part of license renewal, the database needs to be configured with the Portal again since the database password is encrypted using a key from the license. Therefore you should have the database connection details (database type MySQL or Oracle, connection URL), database username and password handy.

20 June 2018 Page 17 of Contact when your Portal license is expiring. Synopsys will send you a secure with a new license file. 2. Stop the web server (Tomcat or WebSphere). 3. In the CSA_Server directory, delete the key-file directory. 4. In the CSA_Server/WEB-INF directory, delete the <customer_name>-secureassist-prikey.der, SecureAssist.license and db.properties files. 5. Restart the web server. Upon accessing the Portal, you will be asked to upload the new license file. 6. Upload the new license file from your browser. You will be redirected to the database setup page. 7. Enter database details (type, connection URL, username, and password). Upon successful database connection, you will be redirected to the login page. License renewal is now complete.

21 June 2018 Page 18 of 76 1 Log in to SecureAssist Enter your username and password on SecureAssist s login screen at (The administrative user account was configured in the last step of the Enterprise Server setup and configuration.) Getting Started When you first log onto the Portal, it opens on the Get Started screen by default. The screen displays these features. Feature Description Learn how it works Install the SecureAssist Plugin Activate Provides a link to the SecureAssist Support screen and its related documentation. Provides links for the download of Eclipse, Visual Studio, and IntelliJ plugins. Provides direction for activating your SecureAssist plugin license. Portal Navigation The navigation menu on the left side of the application allows you to access any of the SecureAssist functional areas at any time. Those functional areas are: Statistics An instant-reporting function that displays the number and types of issues identified and reviewed, guidance searched, and history of vulnerabilities remediated by project or by individual user. Reports Allows administrators to produce various predefined reports for projects or for groups of users. Rulepacks Lists the various rulepacks loaded in the Portal for distribution to the licensed SecureAssist clients. Manage Contains screens for administering users, groups, roles, and your personal account. Settings Contains various settings for configuring the application and viewing license agreements. Get Started The homepage. The following chapters will describe the functionality of the SecureAssist Enterprise Portal in more detail.

22 June 2018 Page 19 of 76 2 Statistics Statistics covering plugin functionality and user activity are periodically sent to the Portal. This information is stored on the Portal server in a database, and there are numerous pre-defined charts and graphs that can be viewed and exported. Project Statistics The Project Statistics screen allows you to instantly view statistical information by project. Run Statistics for a Selected Project 1. Navigate to the Project Statistics window. The Select a Project flyout will automatically open. (To manually open the flyout, click the Select a Project button.) 2. Locate a project by either scrolling though the list of projects or Typing text into the search box to filter the selection or Clicking the filter icon to filter choices by Java,.Net, PHP or JS. 3. Click Select next to the desired project. The dialog closes, and the Project Statistics Options window populates with default information. The following table describes the selection criteria on the Project Statistics Options window. Field/Feature Description Project File Displays the currently selected project for which statistics will be provided. To select a different project, click Change. Displays the currently selected files in the project (by default, All Files). To change the file selection, click Change.

23 June 2018 Page 20 of 76 Field/Feature Description Date Range Type Sort by Show Chart Download CSV Displays the selected range of dates for which statistics will be provided (defaults to the current date). To update, click in the date boxes to select a new start and/or end date. Choose one of the following three types of statistics: Top Findings The ten most frequent findings for the selected project. File Scan Allows you to choose an individual file in a project for which you wish to see statistics. (When selected, Sort by no longer is an option.) Suppression Displays issues suppressed by end users, per project and per project file. Choose to sort results by one of the following: Category Category of rules that were triggered/fired. Title Name of specific rule. Click this button to display a chart based on the selected criteria. Once a chart is displayed, click this button to save the data to a CSV file. 4. From the Project Statistics Options window, make your criteria selections. 5. Click Show Chart. SecureAssist displays a chart based on your selections. 6. If desired, filter the report results by user:

24 June 2018 Page 21 of 76 a. In the Filters pane, click on one or more users to highlight them. b. Click Update. The report updates to display data for the selected users only. Note: For the file scan statistic, data is shown only for a single a user. 7. If desired, click Download CSV to save the data to a CSV file.

25 June 2018 Page 22 of 76 User Statistics The User Statistics screen allows you to view statistics information for a single user. When you access this screen, you will see a list of all your plugin users (the list is populated by your client licenses). Find a User 1. To quickly find a user in the user list, enter text into the Find a User box. The list will automatically filter to show only those user names that contain the text. Run Statistics for a Single User 1. Locate the name of the desired user in the list, then click the Get Statistics button next to it. The User Statistics Options window displays default information. The following table describes the selection criteria on this window. Field/Feature Description User Date Range Type Sort by (available only when Top Findings or Issues Suppressed is selected) Displays the currently selected user for which statistics will be provided. To select a different user, click Change. Displays the selected range of dates for which statistics will be provided (defaults to the current date). To update, click in the date boxes to select a new start and/or end date. Choose one of the following types of statistics: User Session Displays the user s distinct sessions on a timeline. Hovering over a start or end point will display a timestamp. Scanned File Types Pie chart that displays scanned files by type. Searched Guidance Chart displays the guidance categories and the number of times each was searched by the user in given timespan. Also indicates the rulepack in which the guidance was found. Top Findings The ten most-frequent findings for the selected user. Issues Reviewed Chart shows the number of issues found and reviewed by the user. Requires the selection of a project. Issues Suppressed Displays issues suppressed by the user for a given timespan, project, and file. Requires the selection of a project. Choose to sort results by one of the following: Category Category of rules that were triggered/fired. Title Name of rule.

26 June 2018 Page 23 of 76 Field/Feature Description Select a Project (available only when Issues Reviewed or Issues Suppressed is selected) Show Chart Download CSV Click this button to select a project. Click this button to display the statistics based on the selected criteria. Click this button to save the data to a CSV file. 2. From the User Statistics Options window, select your criteria. 3. Click Show Chart. SecureAssist displays a chart based on your selections. 4. If desired, click Download CSV to save the data to a CSV file. Timeseries The Timeseries screen allows you to view graphs showing how the security posture of your project(s) is changing. The graphs can be seen for one or more or all projects in your enterprise. More than one project can be chosen by using project metadata. The change can be seen on a daily, weekly, monthly, or yearly basis. There are two graphs that show change. Both graphs take into consideration reviews done from the beginning of time. Defects Graph. Shows how the number of high, medium, and low defects changes over time.

27 June 2018 Page 24 of 76 Top 5 Vulnerabilities Graph shows how the top five vulnerabilities change over time.

28 June 2018 Page 25 of 76 3 Reports There are two types of reports: Project and User. Several reports can be generated for each type. Unique issues wherever mentioned in this context is defined by uniqueness of each issue's ID. Two issues will never the same issue ID unless a rule fires twice (or more times) in the same line of code. Project Reports Project reports are reports you create for one or more selected projects. When you add a report, the application generates a ZIP archive containing the various report types you ve selected in the New Report flyout. When you navigate to the Project Reports screen, you will see a list of report packages that have already run. This will be blank the first time you access the screen. From this screen you will be able to run a new report from scratch, view the details of previously run report packages, and rerun and download previously run report packages. All project reports provide details based only on the most recent full project/solution scan (the Project Review feature in plugins) of the chosen projects/solutions.

29 June 2018 Page 26 of 76 The following table describes the available project reports. Project Report Description Portfolio Summary Report Lists unique defects per project, number of files scanned, and lines of code based on the most recent project/solution scan date. The report displays the following information. Solution Name: Solution name, shown as in case of non.net project. Project Name: Project name MetaTag Values: Metadata key and values associated with the project, if any. Last Project Scan Date: Timestamp of the most recent full project scan. Total Number of Files: Total count of files in project. Successfully Scanned Files: Number of files successfully reviewed calculated as (Total Number of Files - Files with Errors). Files with Errors: Number of files that were not reviewed or that triggered an error while being reviewed. LOC: Number of lines of code successfully reviewed during the project scan. High Issues: Number of high-severity issues found. Medium Issues: Number of medium-severity issues found. Low Issues: Number of low-severity issues found. Total number of issues: Total number of issues found during the project scan. Developer: ID of developer who initiated the project scan. High (Suppressed): Number of high-severity issues suppressed by the developer after scanning. Medium (Suppressed): Number of high-severity issues suppressed by the developer after scanning. Low (Suppressed): Number of high-severity issues suppressed by the developer after scanning. Total Number of Suppressed Issues: Total number of issues suppressed by the developer after scanning.

30 June 2018 Page 27 of 76 Project Report Description Project Report Project Defect Report Lists all files scanned as a part of project/solution review including most recent scan date, defect counts, lines of code, and developer who performed the last scan. The report displays the following information. Solution Name: Solution name, shown as in case of non.net project. Project Name: Project name. MetaTag Values: Metadata key and values associated with the project, if any. File Path: File's relative path within the project. Last Scan Date: Timestamp of the file's scan. LOC: Number of lines of code in the file. High Issues: Number of high-severity issues found in the file. Medium Issues: Number of medium-severity issues found in the file. Low Issues: Number of low-severity issues found in the file. Total number of issues: Total number of issues in the file. Developer: ID of developer who initiated the project scan. High (Suppressed): Number of high-severity issues from the file that have been suppressed. Medium (Suppressed): Number of medium-severity issues from the file that have been suppressed. Low (Suppressed): Number of low-severity issues from the file that have been suppressed. Total Number of Suppressed Issues: Total number of issues from the file that have been suppressed. Lists all rules that triggered during last project/solution review per project. The report displays the following information. Solution Name: Solution name, shown as in case of non.net project. Project Name: Project name. MetaTag Values: Metadata key and values for associated with the project, if any. Rulepack Name: Name of the rulepack to which the rule belongs. Rulepack Version: Version of the rulepack to which the rule belongs. Rule Id: Rule's unique ID within a rulepack. Rule Title: Rule's title. Issue Category: Rule's vulnerability category. Importance: Severity associated with the rule: HIGH, MEDIUM, or LOW. Total Count (Unique): Number of unique issues because of the specific rule. Total Suppression: Number of issues because of the rule that were suppressed. Total Count: Total number of issues because of the rule.

31 June 2018 Page 28 of 76 Project Report Description Global Defect Report Lists all rules that triggered across all files. The report displays the following information. Rulepack Name: Name of the rulepack to which the rule belongs. Rulepack Version: Version of the rulepack to which the rule belongs. Rule Id: Rule's unique ID within a rulepack. Rule Title: Rule's title. Issue Category: Rule's vulnerability category. Importance: Severity associated with the rule: HIGH, MEDIUM, or LOW. Total Count (Unique): Number of unique issues because of the specific rule. Total Suppression: Number of issues because of the rule that were suppressed. Total Count: Total number of issues because of the rule. Find a Report 1. To quickly find a report in the report list, enter text into the Find a Report box. The list will automatically filter to show only those reports whose names contain the text. View Details of Previously Run Report 1. To view the project associated with a report, click under the Projects column in that report s row. The Filters flyover opens on the right, displaying the project names selected or the metadata used to select the project. 2. To view all other details about a report, click anywhere in the report s row EXCEPT the Projects column. A flyout opens that displays the Report Name, Date Range, Report Types, Start Time and End Time when the report was run, Duration of the report run, and Status. Add a New Report To run a report, you must select a report type, then select the projects you wish to report on. 1. On the Project Report screen, click Add Report. The New Report flyout opens. 2. In Name, enter a title for the report. This is how the report results will be listed on the Project Report screen. 3. In Date Range, select one of the following options: 7 Days, 30 Days, or All.

32 June 2018 Page 29 of Under Report Types, select one or more report types. 5. Click Next. (Next will only be available when you ve entered a name AND selected at least one report type.) The Filters flyout appears, with the title of your report name at the top. You will use this flyout to filter the projects you wish to report on by either Project Name or Metadata. Click on each section title to display the associated fields. Note: Metadata is configured in and reported from the SecureAssist plugin. Please see SecureAssist plugin documentation for more information. 6. On the Filters flyout, select the you wish to report on by either: In the Project Name section, select one or more projects by clicking the Add button next to each OR click Add All to select them all. OR In the Metadata section, specify metadata values to select projects. When more than one key-value pair is specified, the filter will search for projects that meet all key-value pairs. a. In Key, enter the desired field you wish to use to filter. b. In Value, enter the desired filter value. c. Click Add. The filter criteria will be added to a list below the Add feature. d. Add more criteria as desired. 7. Click Save. The Filter flyout closes and you are returned to the Project Reports screen. Your new report should be listed at the

33 June 2018 Page 30 of 76 top of the screen, with its status as Scheduled. The status will toggle to Complete when the report is generated (generation time varies with the size of the report). Download a Report 1. From the Project Reports screen, click anywhere in the row of the desired report EXCEPT the Projects column. A flyout opens with a list of report details and several action buttons. 2. Scroll to the bottom of the flyout and click Download Report. A ZIP file of the report results is automatically saved to your Downloads folder. 3. Open the ZIP file. A separate CSV file is displayed for each report type you selected. Note: The downloaded ZIP files will be named ProjectReports with an appended run date, and CSV files will be named by report type. The name you entered under Report Name appears ONLY on the Project Reports screen. Re-Run a Report There are times you may want to run a report identical to one you ve previously run. Re-Run Report allows you to do this. 1. From the Project Reports screen, click anywhere in the row of the desired report EXCEPT the Projects column. A flyout opens with a list of report details and several action buttons. 2. Scroll to the bottom of the flyout and click Re-Run Report. The Filter flyout closes and you are returned to the Project Reports screen. The re-run report should be listed at the top of the screen, with its status as Scheduled. The status will toggle to Complete when the report is generated. Note: The re-run report will have the identical name as the original run of the report; in other words, you will have two items with the same name in the Project Reports list. Copy to New Report The Copy to New Report function is essentially a save as feature: when you copy to new report, you create a new report using the selections of a previously created report as the default selections. You can then edit those selections before saving the new report, or just create a new report name. 1. From the Project Reports screen, click anywhere in the row of the desired report EXCEPT the Projects column. A flyout opens with a list of report details and several action buttons.

34 June 2018 Page 31 of Scroll to the bottom of the flyout and click Copy to New Report. A flyout opens that displays the previously selected date range and report types, but with a blank for report name. 3. Enter a new report name in Name. 4. If desired, change selections in Date Range and Report Types. 5. Click Next to proceed to the Filters flyout. 6. If desired, change the filter criteria. 7. Click Save. The Filter flyout closes and you are returned to the Project Reports screen. Your new report should be listed at the top of the screen, with its status as Scheduled. The status will toggle to Complete when the report is generated. Delete a Report 1. From the Project Reports screen, click anywhere in the row of the desired report EXCEPT the Projects column. A flyout opens with a list of report details and several action buttons. 2. At the top of the flyout, click Delete Report. A popup asks you to confirm the deletion. 3. Click Yes, delete it. You are returned to the Project Reports screen, and the report instance is deleted from the list.

35 June 2018 Page 32 of 76 User Reports User reports are reports you create for one or more selected user groups. When you add a report, the application generates a ZIP archive containing the various report types you ve selected in the New Report flyout. When you navigate to the User Reports screen, you will see a list of report packages that have already run. This will be blank the first time you access the screen. From this screen you can run a new report from scratch, view the details of previously run report packages, and rerun previously run report packages. The following table describes the available user reports. User Report Description Developer File Coverage Report Lists count of files reviewed by type by each developer. Provides the number of Java, JSP, XML, PHP, FTL, Properties, C#, VB.Net,.config, ASPX and Razor files reviewed by a user on or after the date provided in report criteria.

36 June 2018 Page 33 of 76 User Report Description Developer Defect Report Developer Project Report Lists total number of issues by category for each developer. The report displays the following information. Rulepack Name: Name of the rulepack to which the rule belongs. Rulepack Version: Version of the rulepack to which the rule belongs. Rule Id: Rule's unique ID within a rulepack. Rule Title: Rule's title. Issue Category: Rule's vulnerability category. Importance: Severity associated with the rule: HIGH, MEDIUM, or LOW. User ID: ID of developer who initiated the scan. Count (Unique): Number of unique issues because of the specific rule. Count: Total number of issues because of the rule. Lists all files scanned by each developer. Report includes the most recent date file was scanned by a developer, defect counts, suppression counts, and lines of code for each file. The report displays the following information. Solution Name: Name of the solution to which file belongs, shown as in case of non.net project. Project Name: Name of the project to which file belongs. MetaTag Values: Metadata key and values for associated with the project, if any. File Path: File's relative path within the project. Last Scan Date: Timestamp of the latest file's scan considered. LOC: Number of lines of code in the file. High Issues: Number of high-severity issues found in the file. Medium Issues: Number of medium-severity issues found in the file. Low Issues: Number of low-severity issues found in the file. Developer: ID of developer who initiated the scan. High (Suppressed): Number of high-severity issues from the file that have been suppressed. Medium (Suppressed): Number of medium-severity issues from the file that have been suppressed. Low (Suppressed): Number of low-severity issues from the file that have been suppressed.

37 June 2018 Page 34 of 76 User Report Description Developer Usage Report Lists total defect counts, suppression counts as well as first and last time tool was used by developer. The report displays the following information. User ID: Developer's ID. License Node Number: Index number of user license as well as total number of plugin licenses issues to the user. Last License Renew: Timestamp of developer's latest license renewal. Stats Available: True if stats are available from scans done by the user. First Stats Date: Timestamp of first scan done by the user that was recorded on the portal. Last Stats Date: Timestamp of latest scan done by the user that was recorded on the portal. High Issues: Number of unique high-severity issues found during all scans done after the date provided in the report criteria. Medium Issues: Number of unique medium-severity issues found during all scans done after the date provided in the report criteria. Low Issues: Number of unique low-severity issues found during all scans done after the date provided in the report criteria. High (Suppressed): Number of high-severity issues suppressed found during all scans done after the date provided in the report criteria. Medium (Suppressed): Number of medium-severity issues suppressed found during all scans done after the date provided in the report criteria. Low (Suppressed): Number of low-severity issues suppressed found during all scans done after the date provided in the report criteria. High Issues (Non Unique): Number of high-severity issues found during all scans done after the date provided in the report criteria. Medium Issues (Non Unique): Number of medium-severity issues found during all scans done after the date provided in the report criteria. Low Issues (Non Unique): Number of low-severity issues found during all scans done after the date provided in the report criteria. Find a Report 1. To quickly find a report in the report list, enter text into the Find a Report box. The list will automatically filter to show only those reports whose names contain the text. View Details of Previously Run Report 1. To view the user groups associated with a report, click under the Users column in that report s row. The Filters flyover opens on the right, displaying the selected user groups.

38 June 2018 Page 35 of To view all other details about a report, click anywhere in the report s row except the Users column. A flyout opens that displays the Report Name, Date Range, Report Types, Start Time and End Time when the report was run, Duration of the report run, and Status. Add New Report To run a report, you must select a report type, then select the user groups you wish to report on. 1. On the User Reports screen, click Add Report. The New Report flyout opens. 2. In Name, enter a title for the report. 3. In Date Range, select one of the following options: 7 Days, 30 Days, or All. 4. Under Report Types, select one or more report types. 5. Click Next. (Next will only be available when you ve entered a name AND selected at least one report type.) The flyout is now titled with your report name, and the Included Groups section appears. 6. In the Included Groups section, select one or more groups by clicking the Add button next to each OR click Add All to select them all. 7. Click Save. The Filter flyout closes and you are returned to the User Reports screen. Your new report should be listed at the top of the screen, with its status as Scheduled. The status will toggle to Complete when the report is generated. Download a Report 1. From the User Reports screen, click anywhere in the row of the desired report EXCEPT the Users column. A flyout opens with a list of report details and several action buttons. 2. Scroll to the bottom of the flyout and click Download Report. A ZIP file of the report results is automatically saved to your Downloads folder. 3. Open the ZIP file. A separate CSV file is displayed for each report type you selected. Note: The downloaded ZIP files will be named UserReports with an appended run date, and CSV files will be named by report type. The name you entered under Report Name appears ONLY on the User Reports screen.

39 June 2018 Page 36 of 76 Re-Run an Existing Report Re-Run Report lets you run a report identical to a previously run one. 1. From the User Reports screen, click anywhere in the row of the desired report EXCEPT the Users column. A flyout opens with a list of report details and several action buttons. 2. Scroll to the bottom of the flyout and click Re-Run Report. The Filter flyout closes and you are returned to the Project Reports screen. The re-run report should be listed at the top of the screen, with its status as Scheduled. The status will toggle to Complete when the report is generated. Note: The re-run report will have the identical name as the original run of the report; in other words, you will have two items with the same name in the User Reports list. Copy to New Report When you copy to new report, you create a new report using the selections of a previously created report as the default selections. You can then edit those selections before saving the new report, or just create a new report name. 1. From the User Reports screen, click anywhere in the row of the desired report EXCEPT the Users column. A flyout opens with a list of report details and several action buttons. 2. Scroll to the bottom of the flyout and click Copy to New Report. A flyout opens that displays the previously selected date range and report types, but with a blank for report name. 3. Enter a new report name in Name. 4. If desired, change selections in Date Range and Report Types. 5. Click Next. A list of the users to be included in the report is displayed. 6. Click Save. The Filter flyout closes and you are returned to the User Reports screen. Your new report should be listed at the top of the screen, with its status as Scheduled. The status will toggle to Complete when the report is generated. Delete a Report 1. From the User Reports screen, click anywhere in the row of the desired report EXCEPT the Users column. A flyout opens with a list of report details and several action buttons. 2. At the top of the flyout, click Delete Report. A popup asks you to confirm the deletion. 3. Click Yes, delete it. You are returned to the User Reports screen, and the report instance is deleted from the list.

40 June 2018 Page 37 of 76 4 Rulepacks A rulepack is a JAR file containing rules and guidance used by the SecureAssist plugin to scan your projects. You can load and distribute multiple rulepacks to your plugin users by enabling and disabling them on the Portal. Rulepacks can also be specific and bound to a certain group of SecureAssist plugin users. SecureAssist provides a default rulepack, but you can also create and edit your own custom rulepacks using the Rulepack Configurator that comes bundled with the SecureAssist plugins. (Go to the Guides & Documentation page on the Synopsys website and click Rules & Rulepacks.) Note: You can have more than one default and/or custom rulepacks active. You can also have rulepacks assigned to specific groups by having a user with the group manager role uploading the rulepack. Find a Rulepack 1. To quickly find a rulepack in the rulepack list, enter text into the Find a Rulepack box. The list will automatically filter to show only those rulepacks whose names contain the text. View Details of Rulepack 1. To view all details about a rulepack, click anywhere in the rulepack s row. A flyout displays the following details. All fields have their values set in Rulepack Configurator and are read-only in SecureAssist Portal EXCEPT Status. Field Description Name Status (updateable) Version Plugin Support Type Access Uploaded Name of uploaded rulepack. Enabled or Disabled; indicated by a color bar in the left margin. More than one rulepack can be enabled at one time. Click on this toggle to change the rulepack s status. Version number of uploaded rulepack. List of plugin versions supported by this rulepack. Type of rulepack (Default or Custom). Level of access (Restricted or Unbounded). A restricted rulepack is accessible only by specified plugin users. Date the rulepack was uploaded.

41 June 2018 Page 38 of 76 Upload a Rulepack 1. On the Rulepacks screen, click Upload Rulepack. 2. Browse to locate the desired rulepack, then click Open to upload it. You are returned to Rulepacks, and the new rulepack will appear in the list with a Status of Disabled. Enable/Disable a Rulepack Important! It s recommended to have the most up-to-date rulepack enabled and all outdated versions disabled, as older versions may contain outdated rules. 1. On the Rulepacks screen, view the list of uploaded rulepacks. Enabled rulepacks are indicated by a green bar in the left margin; disabled rulepacks are indicated by a brown bar. 2. Single-click the row of the desired rulepack. The editing flyout appears on the right. 3. Under Status, click Enabled or Disabled to select the desired status. The flyout immediately closes, and the status of the rulepack is updated. Changes to a rulepack become available to users the next time they begin a session.

42 June 2018 Page 39 of 76 Download a Rulepack to Edit on Your Machine 1. On the Rulepacks screen, single-click the row of the desired rulepack. The editing flyout appears on the right. 2. Click Download. A popup asks you to confirm the download. 3. Click Keep. The rulepack file is downloaded to your computer. You can now edit it using Rulepack Configurator. Delete a Rulepack A rulepack can be deleted only if no prior project reports were run using it. If a project report was generated involving the rulepack, the rulepack can be disabled but not deleted. Project reports are based on existing and active rulepacks. 1. On the Rulepacks screen, single-click the row of the desired rulepack. The editing flyout appears on the right. 2. Click Delete Rulepack. A popup asks you to confirm the deletion. 3. Click OK. The flyout closes, and the rulepack is removed from the list.

43 June 2018 Page 40 of 76 5 Manage The Manage function allows you to administer users, groups, and roles used in SecureAssist Portal, as well as your personal account. Portal Users The Portal Users screen lets you manage the various SecureAssist Portal users. These are not plugin users, but the administrators of your SecureAssist system (portal administrators, rulepack administrators, and users who view and generate reports based on plugin user activity). Other than the default Portal server administrator, each user is a local user whose credentials are either stored in the Portal database and authenticated against it or authenticated using LDAP. The default Portal server administrator will always be a local user. However, it can be disabled once other portal users are created. Find a Portal User 1. To quickly find a user in the portal user list, enter text into the Find a Portal User box. The list will automatically filter to show only those portal users whose names contain the text. Add a Portal User 1. On the Portal Users screen, click Add Portal User. The New User flyout opens. 2. Enter a user name in Name. The user name can contain letters and numbers only, NO spaces or special characters. 3. Enter a temporary password in Password for the new user and then confirm it. The password must contain at least six characters, including at least one capital letter, one lowercase letter, and one number. The user will be able to change the password when they log into the system. 4. Click Next to continue. The Roles flyout opens. 5. Select the role or roles you wish to assign to the user by clicking the associated slide buttons, then click Next. The Managed Users flyout opens. 6. If desired, select one or more users to manage, then click Next. The Managed Projects flyout opens. 7. If desired, select one or more projects to manage, then click Save. The flyout closes, and the new user is added to the Portal Users list in alphabetical order with a Status of Active.

44 June 2018 Page 41 of 76 Activate/Deactivate a Portal User 1. On the Portal Users screen, single-click the name of the desired portal user. The editing flyout appears on the right. 2. To change the user s status, click the slide button next to the Status, then click Save. The flyout is closed, and the user s new status is displayed on the Portal Users list. Change/Reset a Portal User s Password 1. On the Portal Users screen, single-click the name of the desired portal user. The editing flyout appears on the right. 2. Click Change Password. The New Password and Confirm New Password fields appear. 3. Enter and confirm a new password for the user. Passwords must contain at least six characters, including at least one capital letter, one lowercase letter, and one number. 4. Click Save. The flyout is closed, and you are returned to the Portal Users list. Edit a Portal User s Assigned Roles 1. On the Portal Users screen, single-click in the Roles column of the desired user s row. The Roles flyout appears on the right. 2. Select the role or roles you wish to assign to the user by clicking the associated slide buttons, then click Save. The flyout closes, and the number of roles for the user is updated in the Portal Users list. Edit a Portal User s Managed Users 1. On the Portal Users screen, single-click in the Users column of the desired user s row. The Managed Users flyout appears. 2. Select the users you wish to assign to the portal user by clicking the Add and Remove buttons, then click Save. The flyout closes, and the number of users for the portal user is updated in the Portal Users list. Plugin Users The Plugin Users screen displays a list of users who have activated a plugin or package license (including each user s IDE and OS). To further view each user s user domain and system ID, click the Extended Info toggle. To view details of an individual user, click the user s row. A flyout opens, displaying the information.

45 June 2018 Page 42 of 76 Find a User 1. To quickly find a user in the Plugin Users list, enter text into the Find a User box. The list will automatically filter to show only those users whose names contain the text. Add a User to a Plugin User Group Note: You can assign individuals to a plugin user group here OR on the Plugin User Groups screen. 1. On the Plugin Users screen, select a user by clicking on its row. A flyout opens with the details for that user. 2. Under Group Assignments, click Add next to one or more user groups you wish to add the user to, then click Save. The flyout closes and the user is now assigned to the selected groups. Deactivate a User Once a plugin user is deactivated, their project scan results and data will still be in the database and appear on reports. 1. On the Plugin Users screen, select a user by clicking on its row. A flyout opens with the details for that user. 2. Toggle the Active button to mark the user as inactive 3. Click Save. The user is now marked as inactive, and the number of developers using SecureAssist has been decreased. Download a CSV 1. On the Plugin Users screen, toggle the Extended Info button to choose whether to include user domains and system IDs in the CSV. 2. Click the Download CSV button. Plugin User Groups The Plugin User Groups screen is where you can create and manage groups of client-side plugin users of SecureAssist. The groups you create here can then be used to filter data in the User Reports section of SecureAssist Portal. There are no default user groups, so the Plugin User Group screen will be blank the first time you visit it. As you add groups, they will be listed on the screen. Note: You can assign individuals to a plugin user group here OR on the Plugin Users screen.

46 June 2018 Page 43 of 76 Find a Plugin User Group 1. To quickly find a plugin user group in the group list, enter text into the Find a Group box. The list will automatically filter to show only those plugin user groups whose names contain the text. Add a Plugin User Group 1. On the Plugin User Group screen, click Add Group. The New User Group flyout opens. 2. In Group Name, enter a name for the new group. 3. In Description, enter a brief description of the group. 4. Click the Add button next to each user you wish to add to the group OR click Add All to add all users. 5. Click Save. The flyout closes, and your new group is added to the Plugin User Groups list. Edit a Plugin User Group 1. On the Plugin User Group screen, click the Edit button next to the desired group. The User Group flyout opens. 2. Make any desired edits to the user group, then click Save. The flyout closes, and you are returned to the Plugin User Groups list. Delete a Plugin User Group 1. On the Plugin User Group screen, click the Edit button next to the desired group. The User Group flyout opens. 2. Click Delete Group. A popup asks you to confirm the deletion. 3. Click Yes, delete it. The popup closes, and the user group is removed from the Plugin User Groups list.

47 June 2018 Page 44 of 76 Roles The Roles screen allows the Server Administrator to create new, custom roles to assign to portal users on the Portal Users screen. You can assign and maintain the specific permissions you want to allow users in each group. There are four default roles in the SecureAssist Portal: GROUP_ADMIN, GROUP_STATS_VIEWER, SERVER_ADMIN, AND STATS_VIEWER. You can see the default permissions assigned to each of these roles in the appendix. There is also a complete list of all permissions and their descriptions. Find a Role 1. To quickly find a role in the role list, enter text into the Find a Role box. The list will automatically filter to show only those roles whose names contain the text. Add a Role 1. On the Roles screen, click Add Role. The New Role flyout opens. 2. Enter a unique role name in Name. 3. If desired, enter a brief description of the new role in Description. 4. Click Next. The Permissions flyout opens. 5. Select the desired permissions, then click Save. (You must select at least one permission in order to save the new role.) The flyout closes and the new role is added to the Roles screen. Edit a Role s Name or Description 1. On the Roles screen, click on the name of the role you wish to edit. The editing flyout opens. 2. Make the desired edits to Name or Description, then click Save. The flyout closes and your changes are saved. Edit a Role s Permissions 1. On the Roles screen, click on the permissions column in the row of the role you wish to edit. The Permissions flyout opens. 2. Make the desired changes to permissions, then click Save. The flyout closes and your changes are saved.

48 June 2018 Page 45 of 76 Delete a Role 1. On the Roles screen, click on the name of the role you wish to delete. The editing flyout opens. 2. Click the Delete Role button. A popup asks you to confirm the deletion. 3. Click Yes, delete it. The flyout closes and the role is deleted from the Role screen. Account The Account screen is where you can update your password for the Portal. Update Your Password 1. On the Account screen, enter your current password in Current Password. 2. Enter your new password in New Password. 3. Re-enter your new password in Confirm New Password. 4. Click Save.

49 June 2018 Page 46 of 76 6 Settings LDAP Configuration The LDAP Configuration screen is where you configure LDAP settings if you choose to use LDAP authentication for the Portal. Administrators can configure the portal to use multiple LDAP servers. The servers are searched in the top-to-bottom order they are placed on the LDAP configuration page.