Veracode Connector Guide

Summary: How to set up and use the Veracode connector in Ivanti Neurons.

The Ivanti Neurons platform provides an API-based connector that integrates with Veracode (SAST and DAST) that enables customers to bring their Veracode findings into Ivanti Neurons to gain visibility into their overall risk due to vulnerabilities in their applications, thereby enabling a more simplified and efficient way to manage those vulnerabilities.

Ivanti Neurons users can configure the connector to pull scan data from Veracode on a periodic basis. Data from Veracode is ingested as both Applications and Application Findings. Ivanti Neurons pulls both DAST and SAST findings from Veracode.

Veracode is cloud-based solution used for scanning both SAST and DAST of the application module. Veracode also provides manual penetration testing of applications.

To set up the connector, the user account must have API access to Veracode.

To obtain API Credentials from Veracode, Click on Organization in the top-right corner. Go to the API Credentials page. Click Generate API Credentials and copy this information for later use.

Navigate to the Automate > Integrations page.

Using the search bar in the upper-right corner of the Integrations page, type Veracode to find the connector.

Locate the Veracode card on the page and click Configuration.

Complete the following fields. These fields include:

Once the fields are complete, click Test Credentials to verify the credentials are correct and can connect to the Veracode instance.

Configure the desired schedule for the connector to retrieve results from the Veracode instance and optionally turn on Enable auto URBA (Update Remediation by Assessment).

Once connector configuration is complete, click Save to create the connector.

After creating the connector, it starts pulling data from Veracode. After configuring the connector, a new entry for it appears at the top of the Integrations page. The connector’s card shows the next scheduled time and date it will fetch results. Check the connector’s status by clicking the History button.

To run the connector on demand, click the Sync icon.

View files pulled from Veracode on the Configuration () > Uploads page.

Scan data pulled from Veracode via the connector is available on the Manage > Applications and Manage > Application Findings pages.

Based on the type of scan performed in Veracode, either SAST or DAST, Ivanti Neurons fingerprints them correspondingly, and their scanner names are VeracodeSAST/VeracodeDAST, respectively. Fingerprinting is done at the file level, and applications are created based out of it. Application findings are also individually marked as VeracodeSAST/VeracodeDAST scanner types.

Assets discovered from the scan data are added to the Manage > Applications page.

The Manage > Application Findings page displays all identified vulnerability details, as shown below.

The Scanner Name associated with these scans is VeracodeDAST/VeracodeSAST, which can be used as a filter on the Applications page in Ivanti Neurons.

The following table provides a high-level mapping of Ivanti Neurons Applications fields to Veracode SAST/DAST fields.

The following table provides a high-level mapping of Ivanti Neurons Application Findings fields to Veracode SAST/DAST fields.