HP Fortify Help

[vadukunnantha_vaduko]

evvarikaina "HP Fortify"  midha experience undha

[IMP]

Just now, vadukunnantha_vaduko said:

evvarikaina "HP Fortify"  midha experience undha

S

[Spartan]

we used to scan our code with Fortify ..kaani Checkmarx ki move ayyam fortify vadilesi..

 

what are ur wants

[vadukunnantha_vaduko]

@Spartan

oka requirement undhi...devops with Fortify........Fortify gurinchi konchem knowledge undali......

youtube lo chusenu but adhi tool separate ga vadala lekunte dhenitho naina automate cheyyala anedhi ardham avvatle........

konchem mi experiance share cheyyandi bhayya......and emmmaina source videos unte links share cheyyandi

 

Thanks

[Spartan]

Just now, vadukunnantha_vaduko said:

@Spartan

oka requirement undhi...devops with Fortify........Fortify gurinchi konchem knowledge undali......

youtube lo chusenu but adhi tool separate ga vadala lekunte dhenitho naina automate cheyyala anedhi ardham avvatle........

konchem mi experiance share cheyyandi bhayya......and emmmaina source videos unte links share cheyyandi

 

Thanks

Fortify code scanner ga vadtaru..mainly C# projects. ki.

example usage chepta.

lets say me source code Git lo undi.

And you need to scan the code and project for every checkin on the Git repo

So You setup a jenkins Job, to trigger the build and scan of that repo.

Scanner will be installed on Slave machines for the jenkins Cluster.

Scan ayyaka a tool report ni Fortify site lo upload chestadi.

Fortify lo u can view latest report, and any security code threats catogerised according to threat levels.

a code, exact line, and how to remidiate such threats chupistadi both tool and report.

then u can alert the developer to fix the code or close it if it is a false alarm.

 

drawback..it checks only C# and .Net codes.

 

.Net Core kavalante u need to use checkmarx or any other scanners.

[TOM_BHAYYA]

I know tontify

[bhaigan]

1 hour ago, Spartan said:

Fortify code scanner ga vadtaru..mainly C# projects. ki.

example usage chepta.

lets say me source code Git lo undi.

And you need to scan the code and project for every checkin on the Git repo

So You setup a jenkins Job, to trigger the build and scan of that repo.

Scanner will be installed on Slave machines for the jenkins Cluster.

Scan ayyaka a tool report ni Fortify site lo upload chestadi.

Fortify lo u can view latest report, and any security code threats catogerised according to threat levels.

a code, exact line, and how to remidiate such threats chupistadi both tool and report.

then u can alert the developer to fix the code or close it if it is a false alarm.

 

drawback..it checks only C# and .Net codes.

 

.Net Core kavalante u need to use checkmarx or any other scanners.

nuvvu keka bhayya

you work only on microsoft technologies or java also

[DammaDakkaDolly]

https://milaap.org/fundraisers/help-for-shanmukh

[masakali]

2 hours ago, Spartan said:

Fortify code scanner ga vadtaru..mainly C# projects. ki.

example usage chepta.

lets say me source code Git lo undi.

And you need to scan the code and project for every checkin on the Git repo

So You setup a jenkins Job, to trigger the build and scan of that repo.

Scanner will be installed on Slave machines for the jenkins Cluster.

Scan ayyaka a tool report ni Fortify site lo upload chestadi.

Fortify lo u can view latest report, and any security code threats catogerised according to threat levels.

a code, exact line, and how to remidiate such threats chupistadi both tool and report.

then u can alert the developer to fix the code or close it if it is a false alarm.

 

drawback..it checks only C# and .Net codes.

 

.Net Core kavalante u need to use checkmarx or any other scanners.

Are you sure it only checks C# or .net, their website claims fortify can scan 23 diff languages including java.

We are also looking into some SAST tools, and fortify is one of them, other contenders for us are sonarqube and veracode. Our developers use findbugs , not at their local level. We will be setting up a Jenkins-sast tool scanning soon

[Spartan]

12 minutes ago, masakali said:

Are you sure it only checks C# or .net, their website claims fortify can scan 23 diff languages including java.

We are also looking into some SAST tools, and fortify is one of them, other contenders for us are sonarqube and veracode. Our developers use findbugs , not at their local level. We will be setting up a Jenkins-sast tool scanning soon

They do multiple languages,

but issue with non-msft platforms code is Fortify generates lots of false positive alarms, which is pain in the a$$ everytime to check for it.

But for C# and .net the % of false positives are very low.

anduke we are moved to other sources for other platforms.

[Spartan]

59 minutes ago, bhaigan said:

nuvvu keka bhayya

you work only on microsoft technologies or java also

i donno man..all mix fruit juice la undi work from last 2 yrs or so

[masakali]

11 minutes ago, Spartan said:

They do multiple languages,

but issue with non-msft platforms code is Fortify generates lots of false positive alarms, which is pain in the a$$ everytime to check for it.

But for C# and .net the % of false positives are very low.

anduke we are moved to other sources for other platforms.

ok cool. We are a java shop, so mostly we are signing with veracode