Example of integrating Veracode in the CI pipeline using an Open Source CLI. Jenkins is used to automate scan and artefact download (into GitHub)

1. v0.5 (nov 2016)
Veracode Automation CLI

2. VERACODE AUTOMATION CLI
Why?
▸ Automate Application Security Scans
▸ Embed security scans in CI
▸ Based on Jenkins build pipeline
▸ Leverage central AppSec skills and distributed (one per
app) network of Security Champions

3. VERACODE CLI

4. VERACODE AUTOMATION CLI
Veracode CLI
▸ Based on existing official REST API
▸ Hosted on GitHub, released under Apache 2.0 license
▸ https://github.com/DinisCruz/veracode-api
▸ Created to improve productivity and to allow easy creation of
scan scripts
▸ Provides easy access to apps, scans, builds and results

5. VERACODE AUTOMATION CLI
List existing applications and builds

6. VERACODE AUTOMATION CLI
Current scan status

7. VERACODE AUTOMATION CLI
Create app, upload file, trigger scan, download, delete app

8. JENKINS INTEGRATION

9. VERACODE AUTOMATION CLI
Product Jenkins job triggers scan (on code push)

10. VERACODE AUTOMATION CLI
Simple configuration

11. VERACODE AUTOMATION CLI
Jenkins job to Download reports
▸ Runs every x minutes (at the moment set to 15m)

12. VERACODE AUTOMATION CLI
Downloads reports that are ready, deletes app

13. VERACODE AUTOMATION CLI
Results stored in GitHub (pushed from Jenkins)

14. CONCURRENT SCANS

15. VERACODE AUTOMATION CLI
Scans

16. Thanks