Skip to main content

IaC Security Presets Management

Presets are sets of queries that you can select to improve the accuracy of the IaC Security scan results. Using presets, you can triage the main capabilities of the IaC Security scanner.

Preset management is a new way to control standard or predefined presets. It allows you to easily create your own presets to suit your needs.

Presets are ordered alphabetically and can be viewed or cloned.

There are 2 preset types:

Predefined Presets

The Checkmarx One presets feature provides predefined presets by default for all Checkmarx One products. Currently, IaC doesn’t have predefined presets.

Predefined presets cannot be deleted and will always be presented in the table before the custom presets.

The Checkmarx IaC Security team handles the base presets and their descriptions, and all versions are aligned across all Checkmarx products.

Custom Presets

Custom presets are presets that are manually created and configured by users.

These presets will be presented in the table after the predefined presets.

It is possible to create a preset using the following methods:

  • Create a preset from scratch - See here.

  • Clone and modify a preset—See here.

Presets User Roles

To be able to manage presets in Checkmarx One, you must have at least one of the following user roles:

  • view-preset - Users with this role can only view presets. If this role is not applied, you won't be able to see presets.

  • create-preset - Users with this role can only create presets.

  • delete-preset - Users with this role can only delete presets.

  • update-preset - Users with this role can only update existing custom presets.

Opening IaC Security Presets Management

To open IaC Security preset management, perform the following:

  1. Log into Checkmarx One.

  2. In the main menu, select Resource Management > IaC Presets.

    1.png

Presets Columns

There are three columns on the IaC Preset Management Page:

  • Preset Name

  • Associated Projects - An indication of which presets are assigned to existing projects. For additional information, see Project Rules.

  • Description - Preset description

You may change the number of presets presented per page by clicking the Rows dropdown at the bottom of the page. The default is 10 rows, which can be changed to 20, 50, or 100.

Viewing a Preset

Viewing a preset lets you see and understand which platforms and queries are included.

To view a preset, perform the following:

  1. Hover over the required preset.

  2. Click on the View option.

    2.png

A panel containing the preset's information opens on the right side of the screen.

3.png

  • The left column indicates the platform (Ansible, Azure Resource Manager, Buildah, etc.).

  • The number next to the platform indicates how many queries are selected for this specific platform.

Creating a Custom IaC Security Preset

To create a custom IaC Security preset, perform the following:

  • Preset Name - Give the preset a name. The preset name must be unique.

  • Description (Optional).

  • Click Next.

    5.png

  1. Click on Add Preset.

    4.png

  2. In the Add Preset dialog, enter the following information:

  3. In the preset configuration dialog, perform the following:

    1. Select the relevant platforms/queries. In addition to the custom presets, all the predefined presets/queries are available.

    2. Click Save preset. The preset will be presented in the table after the predefined presets.

      6.png

Cloning an IaC Security Preset

The clone feature allows you to create a custom preset without creating the entire query set from scratch. You can simply clone the requested preset and modify it according to your needs.

It is possible to clone both predefined and custom presets.

To clone a preset, perform the following:

  1. Hover over the required preset.

  2. Click on the Clone option.

    7.png

  3. In the Cloning preset dialog, perform the following:

    • Preset Name - Give the preset a name. The preset name must be unique.

    • Description (Optional).

    • Click Save Preset.

      14.png

    • After the predefined presets, the preset will be saved and presented in the presets table.

Deleting an IaC Security Preset

Predefined presets can't be deleted. The only presets that can be deleted are custom and cloned presets. They can be deleted only if no projects are associated with it.

For additional information, see IaC Security Scanner Parameters.

To delete a preset, perform the following:

  1. Hover over the required preset.

  2. Click on the Delete option.

    15.png

  3. On the confirmation screen, click on Delete Preset.

    8.png

Applying IaC Security Presets to Scans

Applying a preset to scans can be accomplished on two levels:

  1. Tenant level - This configuration will apply to all the Tenant projects in addition to all the scans.

    For additional information, refer to IaC Security Scanner Parameters.

    The defined preset will be presented with the home_icon.png icon by its name

  2. Project level - This configuration will apply to a specific project and its scans.

    For additional information, refer to IaC Security Scanner Parameters.

IaC Security Preset Usage Verification

To verify which preset was used in a scan, perform the following:

  1. Click on Vertical_Ellipsis.png then Project Settings for a specific project.

    9.png

  2. Click on the Scan History tab.

    10.png

  3. Click on the relevant scan in the table. A panel opens on the right side of the screen

    11.png

  4. Click on the Scan Configuration tab.

    12.png

  5. Expand the IaC Security option and verify the preset and configuration level used.

    13.png
In this section: