Enterprise Updates for 9.5.0 (New Features and Enhancements)
Results Viewer Usability Enhancements
The Results Viewer is enhanced with the following features:
The Similarity ID is displayed in a new column in the Results Viewer.
The Similarity ID is now included in the displayed details.
Message is provided indicating that sources were deleted.
See Usability Enhancements.
Assigned to User in the Report Generation
Previously when generating a report through the Checkmarx Portal, the label “Assign to User“ was displayed in the “Data Report Settings”. This label is now “Assigned to User“.
See Generating Scan Result Reports.
Portal User Settings Persistence
The SAST Web Portal user experience has been improved by enhancing several custom user settings with persistence.
Now instead of being reset to their default states each time the pages reload, custom settings in the Scans, Projects, and Results Viewer pages now persist even when switching between pages, closing the browser, or logging off and then logging back again.
See Portal User Settings Persistence.
Permissions for Creating and Updating Project Configurations
Currently, the save-project permission enables the user to create and save a project.
Starting in 9.5.0, the following additional permission are available:
Permissions for Managing Custom Result States
It is now possible to add, modify, delete and retrieve custom results state using the following APIs:
[GET] /sast/resultStates
[POST] /sast/resultStates
[PATCH] /sast/resultStates/{id}
[DELETE] /sast/resultStates/{id}
In case the project is a branch (created through the Checkmarx Portal), additional details with information of the Original Project Name and Branched on Scan Id are displayed in the Project screen on the General tab. These fields are only displayed when viewing the project configuration, and are informative and are not editable. The new fields are not available when creating a project.
Scan Id and Preset Details
Scan Id information is now available in the Checkmarx Portal, from the following views:
The preset name is now available in All Scan List.
XML reports were improved to provide additional information.
The following query details were added:
To provide these details, a flag called AddQueryMetaDataToXmlReport must be enabled in the database (CxComponentConfiguration table). By default the value is false.
Additional scope to source code was added. The XML reports generated by SAST application contain the text line of the source code for every vulnerability node. The new feature allows adding not only the specific row but also additional rows above and below that row. A following configuration flag was added to CxComponentConfiguration table, XmlReportSourceLinesRange. By default, the value is 0.
Post Scan Actions Improvements
When defining a “Run post scan action“ in the project settings, is now possible to define the following:
Conditional Actions - To set a condition when the post scan action will run, enable the Run only if the scan has new results with a minimal severity of option and select the severity level from the drop-down list. By defining this rule, the post scan action will be triggered only after a successful scan that found new vulnerabilities which did not appear in the previous successful scan. For the first scan executed, the post scan action will run regardless of the Run only if the scan has new results with a minimal severity of condition.
Arguments - Optionally, additional arguments to the post scan action can be specified in the Post scan action arguments field. By having this option, you can set arguments which are project specific. These arguments can be added in addition to the ones specified at the post scan action level.
API Changes - The following APIs were changed to accommodate the new options:
REST API (v4)
SOAP API
Portal - CreateNewProject - Inside the ProjectConfiguration parameter in the ScanActionSettings/ScanAction type, the following new fields are available:
PostScanActionConditions
PostScanActionArguments
Portal - GetProjectProperties - Inside the ProjectConfiguration parameter, the following new fields are available:
PostScanActionConditions
PostScanActionArguments
Source Pulling Performance Improvement for NAS
During source pulling processing, the source repository is cloned to a temporary CxSrc folder where the JobsManager processes it for data such as LOC (lines of code), exclusions, and deletions.
When the CxSrc is configured to use the NAS (Network Attached Storage) for HA (High Availability) environments or DR (Disaster Recovery) purposes, the cloning and JobsManager processes run directly on the NAS. Running these operations over the NAS consumes a large amount of network bandwidth and disk IOPS (input/output operations per second), and reduces performance and can become a bottleneck for systems using NAS storage.
To reduce this bottleneck, the new Source Pulling Performance Improvement feature provides an optimized way to execute the source control cloning and processing steps locally, instead of over the NAS.
See Source Pulling Performance Improvement - Cloud/NAS.
When running multiple scans of the same project on the same source code, users often require that only the newest or oldest scan be kept, and the remaining parallel scans are cancelled. An issued was fixed that caused multiple scans (such as the two oldest scans) to be kept.
In this release:
when setting Keep New (Creating Project -> Advanced Actions tab -> Parallel scan cancellation mode) only the newest scan finishes, while other scans are cancelled.
when setting Keep Old (Creating Project -> Advanced Actions tab -> Parallel scan cancellation mode) only the oldest scan finishes, while other scans are cancelled.
Forcing Scans for Environmental Changes with No Code Changes
Typically, when a scan is triggered in a schedule or from an API call, the source code files are compared to the previous scan. If no code changes are detected the scan is skipped, and all results are copied from the previous scan. However, even if there are no changes to the code, there might be changes to the environment or configuration that could affect the scan results. The new feature allows scans to be triggered even when the changes do not directly affect the code.
See Forcing Scans for Environmental Changes
Log Enhancements with Kibana Dashboards
The capabilities provided by the CxSAST structured logs have been extended with Kibana Dashboards. The following dashboards are now available, improving troubleshooting efforts by providing more detailed information about the various phases of the scans, ultimately resulting in more efficient root cause analysis:
See 9.5 Log Enhancements.
