Veracode SCA Connector

The following is not supported in Tenable FedRAMP Moderate environments. For more information, see the Tenable FedRAMP Product Offering.

The following steps allow you to configure this connector for use with Tenable Exposure Management from start to finish.

Veracode is an application security testing platform. Veracode Software Composition Analysis (SCA) identifies the open-source and third-party components in your applications and flags components with known Common Vulnerabilities and Exposures (CVEs).

Tip: For more information on how third-party integrations work, see Connectors.

Connector Details

Tenable Exposure Management ingests Veracode applications as Code Repository assets, along with their Software Composition Analysis (SCA) component vulnerabilities.

Details Description

Supported products

Veracode Software Composition Analysis (SCA)

Category

Software Composition Analysis (SCA)

Ingested data

Assets and Findings

Ingested Asset Classes

Code Repository

Integration type

UNI directional (the connector transfers data to Tenable Exposure Management in one direction)

Supported version and type

SaaS (latest)

Prerequisites and User Permissions

Before you begin configuring the connector, make sure to:

  1. Confirm that you have a Veracode account with the Software Composition Analysis (SCA) module enabled.

  2. Generate a Veracode API Key ID and API Key Secret in the Veracode Platform.

Generate a Veracode API Key ID and API Key Secret

Veracode displays the Secret Key only once. If you lose it, you must generate a new API Key ID and API Key Secret pair.

  1. Sign in to the Veracode Platform.

  2. In the top-right corner, open the account menu, and select API Credentials.

  3. Click Generate API Credentials.

  4. Select HMAC credentials, then click Generate.

  5. Copy the API ID and Secret Key values to a secure location. You need both values to configure the connector.

Note: Veracode signs API requests using the API ID and Secret Key pair. There is no token to expire or refresh, so the credentials remain valid until you revoke or regenerate them in the Veracode Platform. If you rotate the credentials in Veracode, the connection stops working until you update the connector with the new pair.

Confirm that the API credentials belong to a Veracode user who has permission to view application and finding data for the applications you want the connector to ingest.

Add a Connector

To add a new connector:

  1. In the left navigation menu, click Connectors.

    The Connectors page appears.

  2. In the upper-right corner, click Add new connector.

    The Connector Library page appears.

  3. In the search box, type the name of the connector.

  4. On the tile for the connector, click Connect.

    The connector configuration options appear.

Configure the Connector

To configure the connector:

  1. (Optional) In the Connector's Name text box, type a descriptive name for the connector.

  2. (Optional) To use a preconfigured on-prem connector to connect to this connector, from the Gateway drop-down, select the on-prem connector you want to use for the connector. Otherwise, select Don't use gateway.

    Note: For information about configuring a gateway, see Tenable On-Prem Connector.

  3. From the Region drop-down, select the region of your Veracode account. Each option shows the API base URL for that region.

    Region

    API Base URL

    Veracode Platform Console

    US

    https://api.veracode.com

    analysiscenter.veracode.com

    EU

    https://api.veracode.eu

    analysiscenter.veracode.eu

    US Federal

    Contact your Veracode representative to confirm the API base URL and console domain for your account.

    In the API Key ID text box, type the API ID you generated in Veracode.

    In the API Key Secret text box, type the Secret Key you generated in Veracode.

  4. Data pulling configuration: This configuration has dynamic settings tailored to the specific connector and integration type. The following configurations apply to this connector.

    • In the Asset Retention text box, type the number of days after which you want assets to be removed from Tenable Exposure Management. If an asset has not been detected or updated within the specified number of days, it is automatically removed from the application, ensuring your asset inventory is current and relevant.

      Tip: For more information, see Asset Retention.

  5. In the Test connectivity section, click the Test Connectivity button to verify that Tenable Exposure Management can connect to your connector instance.

    • A successful connectivity test confirms that the platform can connect to the connector instance. It does not, however, guarantee that the synchronization process will succeed, as additional syncing or processing issues may arise.

    • If the connectivity test fails, an error message with details about the issue appears. Click Show tests for more information about the exact error.

  6. In the Connector scheduling section, configure the time and day(s) on which you want connector syncs to occur.

    Tip: For more information, see Connector Scheduling.

  7. Click Create. Tenable Exposure Management begins syncing the connector. The sync can take some time to complete.

  8. To confirm the sync is complete, do the following:

    • Navigate to the Connectors page and monitor the connector's status. Sync is complete once the connector status is Connected.

    • View the sync logs for the connector to monitor the logs for a successful connection.

Veracode SCA in Tenable Exposure Management

Locate Connector Assets in Tenable Exposure Management

As the connector discovers assets, Tenable Exposure Management ingests those devices for reporting.

To view assets by connector:

  1. In Tenable Exposure Management, navigate to the Assets page.

  2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view assets.

    The asset list updates to show only assets from the selected connector.

  3. Click on any asset to view Asset Details.

Locate Connector Findings in Tenable Exposure Management

As the connector discovers individual findings, Tenable Exposure Management ingests those findings for reporting.

To view findings by connector:

  1. In Tenable Exposure Management, navigate to the Findings page.

  2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view findings.

    The findings list updates to show only assets from the selected connector.

  3. Click on any asset to view Finding Details.

Data Mapping

Tenable Exposure Management integrates with the connector via API to retrieve relevant weakness and asset data, which is then mapped into the Tenable Exposure Management system. The following tables outline how fields and their values are mapped from the connector to Tenable Exposure Management.

Code Repository Mapping

Tenable Exposure Management UI Field

Veracode SCA Field
Unique Identifier guid
Asset Name profile.name
Code Repository URL profile.git_repo_url or guid
Created At created
First Observed At created
Last Observed At last_completed_scan_date
External Tags profile.tags
Asset Custom Attributes

Business Criticality: profile.business_criticality

Policy Compliance Status: profile.policies.0.policy_compliance_status

Policy Name: profile.policies.0.name

Business Unit: profile.business_unit.name

Teams: profile.teams

App Profile URL: app_profile_url

Results URL: results_url

Veracode Application ID: id

Veracode Application GUID: guid

Finding Mapping

Tenable Exposure Management UI Field

Veracode SCA Field
Vendor ID issue_id
Finding Name finding_details.cve.name
Description description
Solution finding_details.component_filename and finding_details.version
CVEs finding_details.cve.name
CWEs finding_details.cwe and finding_details.cwe.id
CVSS3 Base Score finding_details.cve.cvss3.score
CVSS3 Base Vector finding_details.cve.cvss3.vector
CVSS3 Base Severity finding_details.cve.cvss3.severity
EPSS Score finding_details.cve.exploitability.epss_score
EPSS Percentile finding_details.cve.exploitability.epss_percentile
Source Code Package Name finding_details.component_filename
Source Code Package Version finding_details.version
First Seen finding_status.first_found_date
Last Seen (Observed) finding_status.last_seen_date
Finding Custom Attributes

Veracode Issue ID: issue_id

Component ID: finding_details.component_id

Product ID: finding_details.product_id

Language: finding_details.language

Licenses: finding_details.licenses

License Risk Ratings: finding_details.licenses

SCA Scan Mode: finding_details.metadata.sca_scan_mode

SCA Dependency Mode: finding_details.metadata.sca_dep_mode

CVE Severity: finding_details.cve.severity

Exploit Observed: finding_details.cve.exploitability.exploit_observed

Prevalence: count

Violates Policy: violates_policy

Context Type: context_type

Finding Status Mapping

Tenable Exposure Management Status

Veracode SCA Status

Active

OPEN

Fixed

CLOSED or FIXED

An approved mitigation (false positive or accepted risk)

Finding Severity Mapping

Tenable Exposure Management Severity

Veracode SCA Score

Critical

CVSS: 9.0 - 10.0

Severity: 5 (Very High)

High

CVSS: 7.0 - 8.9

Severity: 4 (High)

Medium

CVSS: 4.0 - 6.9

Severity: 2 - 3 (Medium)

Low

CVSS: 0.1 - 3.9

Severity: 1 (Low)

None

CVSS: 0.0

Severity: 0 (Informational)

Note: For Veracode SCA, Tenable uses the finding_details.cve.cvss3.score field to determine severity. If finding_details.cve.cvss3.score is not available, Tenable uses the finding_details.severity field from the connector.

Status Update Mechanisms

Every day, Tenable Exposure Management syncs with Veracode to receive updates on existing findings and assets and to retrieve new ones (if any exist).

The following table describes how the status update mechanism works in the connector for findings and assets that Tenable Exposure Management ingests.

Update Type in Tenable Exposure Management

Mechanism (When?)

Archiving Assets

  • An asset appears in Tenable Exposure Management, and the next connector sync does not return it.

Change a Finding status from "Active" to "Fixed"

  • The finding status changes to CLOSED or FIXED on the Veracode side.

  • Veracode approves a mitigation for the finding (false positive or accepted risk).

  • The next connector sync does not return the finding.
Note: Tenable Exposure Management shows updates from Veracode only after the next scheduled connector sync completes (once a day).

Uniqueness Criteria

Tenable Exposure Management uses defined uniqueness criteria to determine whether to treat an ingested asset or finding as a distinct record. These criteria define how Tenable Exposure Management identifies and counts assets and findings from each connector.

Tip: To learn more about data deduplication and uniqueness criteria, see Third-Party Data Deduplication in Tenable Exposure Management.

The uniqueness criteria for this connector are as follows:

Data

Uniqueness Criteria

Asset

guid (uniquely identifies the Veracode application)

Vulnerability

finding_details.cve.name (uniquely identifies the CVE)

Finding

finding_details.component_id + finding_details.cve.name + context_guid (uniquely identifies a CVE in a specific component on a specific application)

Support and Expected Behavior

Support Limitations and Expected Behavior

This section outlines any irregularities, expected behaviors, or limitations related to integration of the connector and Tenable Exposure Management. It also highlights details about ingested and non-ingested data to clarify data handling and functionality within this integration.

  • This connector ingests Software Composition Analysis (SCA) findings only. To ingest Static Analysis (SAST) flaws, configure the Veracode SAST Connector.

  • The connector does not ingest SCA findings that have no CVE name.

  • If Veracode reports the same CVE more than once for the same component on the same application, Tenable Exposure Management shows a single finding.

  • The connector retrieves findings for each application separately. For large application portfolios, a sync can take longer to complete.

API Endpoints in Use

API

Use in Tenable Exposure Management

appsec/v1/applications/

Retrieves the total count of Veracode applications, to size the asset sync.

appsec/v1/applications/

Retrieves the full list of Veracode applications and creates one Code Repository asset for each.

appsec/v2/applications/

Retrieves the finding count for each application, to size the findings sync.

appsec/v2/applications/

Retrieves the SCA component vulnerabilities for each application and maps them to findings.

Data Validation

This section shows how to validate and compare data between Tenable Exposure Management and the Veracode Platform.

Asset Data Validation

Objective: Ensure the number of applications in Veracode SCA aligns with the number of assets displayed in Tenable Exposure Management.

In the Veracode Platform:

  1. Navigate to Software Composition Analysis.

    Note the total number of applications.

In Tenable Exposure Management:

  1. Locate your connector assets.

  2. Compare the total number of assets between Veracode SCA and Tenable Exposure Management.

Expected outcome: The application count in Veracode SCA and the filtered asset count in Tenable Exposure Management match.

If an asset is not visible in Tenable Exposure Management, check the following conditions:

  • The application does not have a valid guid value, so the connector cannot uniquely identify it.

  • The application appeared in Veracode after the connector's last scheduled sync, and no sync has run since.

  • The connector's last scheduled sync failed. Check the connector's sync history for an error.

  • The Veracode user that owns the API credentials does not have permission to view the application.

  • Tenable Exposure Management archived the asset because the connector's last sync did not return it.

    Tip: To learn more about how Tenable Exposure Management archives assets and changes finding status, see Status Update Mechanisms.

Finding Data Validation

Objective: Ensure the number of component vulnerabilities for an application in Veracode SCA aligns with the number of findings for the matching asset in Tenable Exposure Management.

Tenable recommends that you validate findings for one application at a time. This way, you can trace any difference to a single set of records.

In the Veracode Platform:

  1. In Software Composition Analysis, click the name of the application you want to validate.

  2. In the SCA results for the application, note the number of component vulnerabilities.

In Tenable Exposure Management:

  1. Locate your connector assets, and click the asset that matches the application.

  2. On the Findings tab, count the findings from the Veracode SCA connector.

  3. Compare the number of findings between Veracode SCA and Tenable Exposure Management.

Expected outcome: The number of findings in Tenable Exposure Management is equal to or lower than the number of component vulnerabilities in Veracode SCA.

The number of findings in Tenable Exposure Management can be lower for the following reasons:

  • The connector does not ingest findings that have no CVE name.

  • Tenable Exposure Management combines Veracode findings for the same CVE, component, and application into one finding.

  • Veracode reported the finding after the connector's last scheduled sync.

If a finding is missing from Tenable Exposure Management or no longer active, check the following conditions:

  • The finding has a Fixed status and appears under the Fixed state on the Findings page.

  • Tenable Exposure Management archived the related asset.

    Tip: To learn more about how Tenable Exposure Management archives assets and changes finding status, see Status Update Mechanisms.

  • The application has never completed an SCA scan, so it has no findings to report.