From 20b76c21f607169b2a9c35a286f10ed2d3089f6b Mon Sep 17 00:00:00 2001 From: Greg Anderson Date: Tue, 21 Jul 2026 20:38:54 -0600 Subject: [PATCH] docs(connectors): HCL AppScan connector reference MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Document the HCL AppScan connector (ASoC + AppScan 360°): prerequisites (API Key ID/Secret), the Location/Provider/Minimum-Severity mappings, and the whole-account application -> Record + issue -> finding model (title suffixes, severity map, CWE, remediation/advisory, host:port endpoint, static/dynamic by scan technology, status). Companion to connectors#749 and dojo-pro#1990. sc-13873 Co-Authored-By: Claude Fable 5 --- .../connectors/connectors_tool_reference.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/docs/content/import_data/pro/connectors/connectors_tool_reference.md b/docs/content/import_data/pro/connectors/connectors_tool_reference.md index 1ba6cb02969..5a8a9b73544 100644 --- a/docs/content/import_data/pro/connectors/connectors_tool_reference.md +++ b/docs/content/import_data/pro/connectors/connectors_tool_reference.md @@ -568,6 +568,25 @@ DefectDojo creates a separate Record for each domain you have verified with HIBP See the [Have I Been Pwned API documentation](https://haveibeenpwned.com/API/v3) for more information. +## **HCL AppScan** + +The HCL AppScan connector uses the AppScan v4 REST API to import issues from **AppScan on Cloud (ASoC)** or a self-hosted **AppScan 360°** (both share the API). It syncs the whole account: DefectDojo discovers every application and creates a Record for each, then imports that application's issues (DAST, SAST and IAST) as findings. + +#### Prerequisites + +You will need an AppScan **API key** — a Key ID and Key Secret generated under your AppScan account settings (API Key). The connector exchanges them for a short-lived session token on each run; the Key ID, Key Secret and token are never logged. + +#### Connector Mappings + +1. Enter the AppScan console URL in the **Location** field: for ASoC use `https://cloud.appscan.com` (or `https://eu.cloud.appscan.com` for the EU region); for AppScan 360° use your instance host. +2. Set **Provider** to `ASOC` for AppScan on Cloud, or `A360` for a self-hosted AppScan 360°. +3. Enter the **API Key ID** and **API Key Secret**. +4. Optionally, set a **Minimum Severity** to limit which findings are imported. + +DefectDojo maps each AppScan **application** to a Record (VEP) and each **issue** to a finding: the title is the issue type with its domain / entity / cause-id / URL / path appended; the severity maps Informational → Info (Low/Medium/High/Critical pass through); the CWE, a labeled description, the remediation and advisory, and the host/port endpoint are carried over. Issues from static analysis are recorded as static findings and dynamic/interactive issues as dynamic findings; open issues are active and fixed/passed issues are mitigated. + +See the [AppScan REST API documentation](https://help.hcl-software.com/appscan/ASoC/appseccloud_rest_apis.html) for more information. + ## **IriusRisk** The IriusRisk connector uses an API token to pull threat modeling data from your IriusRisk instance.