SonarCloud Connector Guide

Summary: How to set up and use the SonarCloud connector in RiskSense.

SonarCloud is a cloud-based code quality and security service. SonarCloud operates as a static code analyzer that discovers security and quality issues in source code by interacting directly with the repositories.

RiskSense provides an API-based connector that integrates with SonarCloud, enabling customers to bring their SAST findings. This connector allows customers to gain visibility into their overall risk due to vulnerabilities in their source code and enable a simpler, more efficient way to manage those vulnerabilities.

SonarCloud is a cloud-based solution. RiskSense requires a user account with the following access to communicate with and pull data from SonarCloud.

The following API calls are performed during a connector run to pull security vulnerabilities from SonarCloud into RiskSense.

First, log in to your SonarCloud instance with the designated user account. Navigate to My Account > Security. Enter the token name and click the Generate button.

Copy the user token, as it is only displayed once. Use this token for API authentication.

In addition to the user token, the RiskSense connector also needs the SonarCloud Organization Key. This acts as a key indicator for pulling all the associated projects within it.

First, navigate to the My Organizations menu option.

Copy the Organization Key.

Navigate to the Automate > Integrations page.

Using the search bar in the upper-right corner of the Integrations page, type SonarCloud to find the connector.

Locate the SonarCloud card on the page and click Configuration.

In the new window under Connection, complete the required fields, as described below.

Click the Test Credentials button to ensure the credentials are correct and have the necessary access to make SonarCloud API calls.

Under Schedule, you can configure the desired schedule for the connector to retrieve results from the SonarCloud instance and optionally select the Oldest Scan Data Pull configuration.

The Oldest Scan Data Pull dropdown provides users the flexibility to pull the oldest reports from the last 30, 60, 90, 180 days, and 1 year.

Under Connector Specific Options, select the required options from the list.

Users have the option to ingest the selected SonarCloud findings. RiskSense can ingest more than one finding type.

Users can optionally turn on Enable auto URBA (Update Remediation by Assessment).

On marking the Create Assets that do not have vulnerabilities options, RiskSense will create applications with zero findings. This option will be selected by default, and the user can opt to turn it off.

Click the Save button to save the connector’s configuration and create the connector. Once saved, the connector is now visible on the Integrations page under Currently Configured Integrations.

Clicking the History button displays the connector details for each pull. The Sync button allows users to perform on-demand sync. The Edit button allows the user to edit the connector configuration. The Delete button allows the user to delete the connector.

Once files have been processed on the Uploads page, view the ingested data by navigating to the Applications and Application Findings pages.

This table showcases the high-level mapping of SonarCloud fields in RiskSense.

The following fields from SonarCloud are converted into RiskSense tags. Use these tags for searching, playbook automation, and better visualization in RiskSense Dashboards.

The following fields in RiskSense are defined for SonarCloud, along with their default values.

Within RiskSense, you will notice several dates on the Findings page. When importing SonarCloud data, RiskSense uses the following criteria to populate these date fields.