--- title: Micro Focus Fortify Software Security Center (SSC) Connector Guide slug: rbvm-help/micro-focus-fortify-software-security-center-ssc-connector-guide createdAt: 2026-10-26T13:51:22.739Z --- **Summary**: How to set up and use the Micro Focus Fortify Software Security Center (SSC) connector in Ivanti Neurons RBVM/ASPM/VULN KB. ## About the Fortify Software Security Center Integration The Ivanti Neurons RBVM/ASPM/VULN KB platform provides an API-based connector that integrates with **Fortify Software Security Center (SSC)**, enabling customers to bring in their SAST and DAST findings from **Fortify Static Code Analyzer (SCA)** and **Fortify WebInspect **products into Neurons RBVM/ASPM/VULN KB. This allows customers to gain visibility into their overall risk due to vulnerabilities in their source code/web applications and enable a simpler, more efficient way to manage those vulnerabilities. The integration allows security and vulnerability teams to: - Understand their exposure to vulnerabilities and threats in their business critical web applications. - View top software flaws in their web applications based on mappings such as CWE Top 25, OWASP Top 10, SANS Top 25, etc. - Prioritize and remediate top weaknesses and flaws. Neurons RBVM/ASPM/VULN KB users can configure the connector to pull scan data from Fortify Software Security Center on a periodic basis. ## How it Works The Neurons RBVM/ASPM/VULN KB Fortify connector programmatically connects with Fortify SSC to pull in scan data for either source code or web applications. It is assumed that a user has already setup Fortify SCA, Fortify WebInspect, and Fortify SSC. For the Ivanti Neurons Fortify connector to work properly, the following steps must be performed: 1. The user runs a scan on a project from Fortify SCA for static files, or from Fortify WebInspect for dynamic URLs, and generates a .fpr file. 2. The user then uploads the .fpr file to Fortify SSC. 3. The Neurons RBVM/ASPM/VULN KB Fortify connector should be configured with its Fortify SSC credentials and enabled. 4. The connector establishes a connection with Fortify SSC and pulls scan data via the API. 5. The scan data is parsed and mapped within the Neurons RBVM/ASPM/VULN KB platform and displayed within the Application views. ## Fortify Product Overview Fortify SSC is used for processing .fpr files (scanned results) generated by both Fortify SCA and Fortify Web Inspect. Download Fortify SSC from the following URL: **[Fortify Software Security Center](https://www.microfocus.com/en-us/products/software-security-assurance-sdlc/overview)** ## Generating Fortify Scan Files ### Fortify Prerequisites Navigate to the [Fortify website](https://www.microfocus.com/en-us/products?trial=true) and sign up for an account. Download the following products: - **[Fortify Static Code Analyzer](https://www.microfocus.com/en-us/products/static-code-analysis-sast/overview)** - **[Fortify WebInspect](https://www.microfocus.com/en-us/products/webinspect-dynamic-analysis-dast/overview)** ## Installation and Scan Report Generation ### Fortify SCA Install Fortify SCA by following the Windows installer’s instructions. A static code analysis report must be generated for further processing. This can be done by following these steps. *(***Note***: Webgoat is an open-source Java application that was deliberately created to have security vulnerabilities that can be scanned by application scanners.)* ### Performing a Fortify Static Scan C:\Program Files\Fortify\Fortify\_SCA\_and\_Apps\_19.1.0\Samples\advanced\webgoat>sourceanalyzer -b WebGoat5.0 -clean C:\Program Files\Fortify\Fortify\_SCA\_and\_Apps\_19.1.0\Samples\advanced\webgoat>sourceanalyzer -b WebGoat5.0 -source 1.5 -cp "WebGoat5.0/WebContent/WEB-INF/lib/\*.jar" WebGoat5.0/JavaSource WebGoat5.0/WebContent C:\Program Files\Fortify\Fortify\_SCA\_and\_Apps\_19.1.0\Samples\advanced\webgoat>sourceanalyzer -b WebGoat5.0 -scan -f C:\Us ### Fortify Web Inspect Install Fortify WebInspect by following the Windows installer’s instructions and use the following steps to perform a dynamic application scan: Open the WebInspect launcher. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/p1Ga2VhXbZA5SYNgXQ_96_micro-focus-fortify-software.png" alt="Fortify Scan - Start Page" position="flex-start" size="90" width="633" height="389" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software.png" showCaption="false"} Select **Start a Guided Scan** and follow the steps to perform a scan. Once the scan is complete, click the **Manage Scans** tab to view the scans that have been performed. Select a scan and click **Export > Export Scan to Software Security Center**. This downloads an .fpr file. ![Fortify Scan - Export Scan Location](https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/PD8WDwG7hg7PYTlrZpcff_micro-focus-fortify-software1.png) ### Uploading Files in Fortify Software Security Center Log in to Fortify SSC as a user with upload access. Navigate to the **Applications** tab and click **New Application Version**, following the instructions provided in the tab. ## Configuring the Fortify Connector in Ivanti Neurons In the Neurons RBVM/ASPM/VULN KB platform, navigate to the **Automate > Integrations** page. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/N6T9UnB5FOanUDKWj7uEe_palo-alto-xpanse-expander.png" alt="Navigation - Automation - Integrations" position="flex-start" size="33" width="229" height="151" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" showCaption="false"} Search for **Fortify Security** and click the **Configuration** button on the Micro Focus Fortify Security Center (WebInspect/SCA) connector card. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/IGEkJZH5gj8Ba9Cg48K_I_micro-focus-fortify-software2.png" alt="Fortify - Fortify Security Center Integration Card" position="flex-start" size="98" width="688" height="417" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_2.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_2.png" showCaption="false"} Enter your Fortify credentials in the **Create Connector** form. The fields include: - **Name**: Connector instance name. - **URL**: Fortify SSC instance URL. - **User Name and Password**: User credentials that can access the Fortify SSC instance. - **Network**: Neurons RBVM/ASPM/VULN KB network name (ingested applications and their findings will be associated with this network). - **SSL**: Fortify SSC instance SSL certificate. Once the form is complete, click the **Test Credentials** button to ensure the credentials are valid. :::hint{type="info"} **Note: **For self-signed Fortify SSC domains, you must upload the SSL certificate for verification. ::: ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/fo3PqZf0lw8Dn1R7z_9JW_micro-focus-fortify-software3.png" alt="Fortify - Connector Setup" position="flex-start" size="88" width="614" height="556" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_3.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_3.png" showCaption="false"} If the credential test succeeds, the **Save** button is enabled. Click the **Save** button to save the connector’s configuration. Users can schedule the frequency for running the connectors, and Update Remediation by Assessment (URbA) can also be enabled. Neurons RBVM/ASPM/VULN KB then pulls files from Fortify SSC according to the chosen schedule. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/16FLH7lmP2TSgkJoziMMU_micro-focus-fortify-software4.png" alt="Fortify - Connector Specific Options" position="flex-start" size="70" width="492" height="406" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_4.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_4.png" showCaption="false"} On clicking the Save button, the connector begins pulling data from Fortify SSC into Neurons RBVM/ASPM/VULN KB. Users can monitor the connector status by clicking the **History** button on the connector card. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/42ge0-NBU67RmTKipQaBX_micro-focus-fortify-software5.png" alt="Fortify - Connector History" position="flex-start" size="75" width="522" height="412" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_5.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_5.png" showCaption="false"} Files pulled from Fortify SSC can be viewed on the **Uploads** page. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/LPVPxuxnvCGD0nMf9v0Ar_micro-focus-fortify-software6.png" alt="Fortify - Uploads Page" position="flex-start" size="98" width="687" height="162" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_6.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_6.png" showCaption="false"} To run the connector on demand, click the **Sync** button on the connector card. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/CRLwxsB8C93ZOqAIj7-OK_micro-focus-fortify-software7.png" alt="Fortify - Connector Card" position="flex-start" size="33" width="233" height="280" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_7.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_7.png" showCaption="false"} ## Data Visualization in Neurons RBVM/ASPM/VULN KB Once files have been processed on the Uploads page, the user can visualize the ingested data by navigating to either the **Applications** or **Application Findings** views. ### Applications To identify Fortify-related projects, open the filter pane. Select **Scanner Name** as the filter category and begin typing Fortify in the value field to show related scanners. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/TamKXwYPEr6_iBzEJvIdS_micro-focus-fortify-software8.png" alt="Fortify - Filter for Fortify SCA or WebInspect in RS" position="flex-start" size="98" width="687" height="241" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_8.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_8.png" showCaption="false"} Clicking an individual row brings up the detail pane, showing in-depth information on the project. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/pFhJs0UDtOgu_bJuyM1or_micro-focus-fortify-software9.png" alt="Fortify - Application Detail Pane Information" position="flex-start" size="51" width="359" height="529" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_9.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_9.png" showCaption="false"} ### Application Findings For a given project on the Applications page, the user may click on the value under **Total** to navigate to the **Application Findings** view and see findings associated with that project. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/MfS4_N-n5o_3U-a3La_Ej_micro-focus-fortify-software10.png" alt="Fortify - Application Findings Page" position="flex-start" size="98" width="686" height="166" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_10.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_10.png" showCaption="false"} Clicking on individual findings brings up the finding detail pane. Data associated with the finding, including **vulnerability** information, is shown here. ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/LGzsbQefLQ-vaZJGjYvID_micro-focus-fortify-software11.png" alt="Fortify - Application Findings Detail Pane" position="flex-start" size="52" width="364" height="516" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_11.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_11.png" showCaption="false"} Fortify SSC includes a **Kingdom** as one of its project properties. This field is mapped into Neurons RBVM/ASPM/VULN KB using a special new filter called **Fortify SSE.** ::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/2htjW83JqdTmxQ4-_Ooo-_micro-focus-fortify-software12.png" alt="Fortify - Fortify SSE Filter" position="flex-start" size="93" width="652" height="434" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_12.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Micro Focus Fortify Software_12.png" showCaption="false"} ## Neurons RBVM/ASPM/VULN KB Mapping of Fortify SSC Data The table below provides the complete mapping between fields in Fortify SSC and the Neurons RBVM/ASPM/VULN KB platform. | **Section** | **Neurons** **RBVM/ASPM/VULN KB Field** | **Fortify SCA** | **Fortify WebInspect** | **Filterable** | | -------------------- | --------------------------------------- | --------------------------------------- | --------------------------------------- | -------------- | | Applications | Name | Application name and version | Application name along with the version | Yes | | Total | Total number of associated findings | Total number of associated findings | No | | | Application Findings | Title | Category | Category | Yes | | Url | Affected File Path | Affected URL | Yes | | | Description | Overview + Details | Application name along with the version | No | | | WebApplication | Application name along with the version | Application name along with the version | Yes | | | Severity | Criticality | Criticality | Yes | | | Output → Fortify SSE | Kingdom | Kingdom | Yes | | | Output → Instance ID | Instance Id | Instance Id | Yes | | | Output → Impact | Impact | Impact | No | | | Output → Confidence | Confidence | Confidence | No | | | Output → Probability | Probability | Probability | No | | | Output → Accuracy | Accuracy | Accuracy | No | | | Output → Likelihood | Likelihood | Likelihood | No | | | Output → Implication | Implication | Implication | No | | | Output → References | References | References | No | | ## Useful Filters ### Application Filters | **Filter Field** | **Fortify SCA** | **Fortify WebInspect** | | ---------------- | ------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | | Scanner Name | A new scanner name Fortify SCA has been added for filtering applications. | A new scanner name Fortify WebInspect has been added for filtering applications. | | Scanner Type | Scanner type SAST. | Scanner type DAST. | ### Application Finding Filters | **Filter Field** | **Fortify SCA** | **Fortify WebInspect** | | ---------------- | ---------------------------------------------------------- | ---------------------------------------------------------- | | Finding Type | Finding type SAST has been added for application findings. | Finding type DAST has been added for application findings. | | Fortify SSE | Kingdom of each finding. | Kingdom of each finding. |