Security Step Settings Reference
- Scan Approach Types
- Scanners, Target Types, and Scan Approach
- Test Targets
- Using Scanner Providers in the Security Step
- All Scan Types
- Repository Scan Type Settings
- Container Scan Type Settings
- Instance Scan Type Settings
- Configuration Scan Type Settings
- Aqua Trivy
- AWS Security Hub
- Bandit
- Black Duck Open Hub
- Brakeman
- Burp
- Checkmarx
- Data Theorem
- Docker Content Trust (DCT)
- Docker Content Trust (clair)
- External (JSON upload v2)
- Fortify
- Fortify on Demand
- Metasploit
- Nessus
- Nexus IQ
- Nikto
- Nmap ("Network Mapper")
- OpenVAS
- OWASP
- Prowler
- Qualys Web Application Scanning (WAS)
- Reapsaw
- ScoutSuite
- ShiftLeft
- Sniper
- Snyk
- SonarQube SonarScanner
- Tenable.io
- Prisma Cloud (formerly Twistlock)
- Veracode
- WhiteSource
- JFrog Xray
- Zed Attack Proxy (ZAP)
This topic includes all the Security step settings for each of the scanner providers supported by Harness.
For details on using the Security step, see Security Testing Orchestration Quickstart (Public Preview).
Scan Approach Types
Harness Security Testing Orchestration integrates with multiple scanners and targets. Different types of scan approaches can be done on each scanner-target combination:
- orchestratedScan: orchestratedScan is fully orchestrated. A new scan is orchestrated and the scan results are normalized and compressed by Security Testing Orchestration.
- manualUpload: manualUpload is not orchestrated. Think of this as ingestion-only. For a scan that was done previously (or an earlier step in the a Pipeline), the results are presented to Security Testing Orchestration for normalization and compression.
- dataLoad: dataLoad is partially orchestrated. A previously run scan where the results exist in scan tool vendors SaaS. The data is pulled, normalized, and compressed for Security Testing Orchestration.
The scanner, targets, and scan approach combinations are covered in the next section.
Scanners, Target Types, and Scan Approach
The following scanners are supported. See Security Testing Orchestration Quickstart (Public Preview).
Scanner Name | Scan Target Type | Scan Approach |
Aqua Trivy | container | orchestratedScan, manualUpload |
Bandit | repository | orchestratedScan, manualUpload |
Black Duck | repository, container | orchestratedScan, manualUpload |
Brakeman | repository | orchestratedScan, manualUpload |
Burp | instance | manualUpload |
Checkmarx | repository | orchestratedScan, dataLoad, manualUpload |
Data Theorem | repository | dataLoad, manualUpload |
Docker Content Trust (DCT) | container | orchestratedScan, manualUpload |
Docker Content Trust (DCT) (docker-content-trust and clair) | container | orchestratedScan, manualUpload |
External (JSON upload v2) | container, repository, instance, configuration | orchestratedScan, manualUpload |
Fortify on Demand | repository | orchestratedScan, dataLoad, manualUpload |
Metasploit | instance | orchestratedScan, manualUpload |
Nessus | instance | orchestratedScan, manualUpload |
Nexus IQ | instance | orchestratedScan, manualUpload |
Nikto | instance | orchestratedScan, manualUpload |
Nmap ("Network Mapper") | instance | orchestratedScan, manualUpload |
OpenVAS | instance | orchestratedScan, manualUpload |
OWASP | repository | orchestratedScan, manualUpload |
Prowler | repository | orchestratedScan, manualUpload |
Qualys Web Application Scanning (WAS) | instance | manualUpload |
Reapsaw | repository | manualUpload |
ShiftLeft | repository | orchestratedScan, dataLoad, manualUpload |
Sniper | instance | orchestratedScan, manualUpload |
Snyk | container | orchestratedScan, manualUpload |
SonarQube SonarScanner | repository | orchestratedScan, dataLoad, manualUpload |
Tenable.io | instance | orchestratedScan, dataLoad, manualUpload |
Prisma Cloud (formerly Twistlock) | container | orchestratedScan, dataLoad, manualUpload |
Veracode | repository | orchestratedScan, dataLoad, manualUpload |
WhiteSource | repository | orchestratedScan, manualUpload |
JFrog Xray | container | manualUpload |
Zed Attack Proxy (ZAP) | instance | orchestratedScan, manualUpload |
Test Targets
The following table specifies where the target to be tested is located.
Target Name | Target Type |
azure | repository |
bitbucket | repository |
github | repository |
gitlab | repository |
local_image | container |
docker_v2 | container |
jfrog_artifactory | container |
aws_ecr | container |
website | instance |
Using Scanner Providers in the Security Step
To use any supported scanner provider in the Harness Security step, you simply need to provide the setting:value pairs for the scanner.
For example, here are the setting:value pairs for Aqua Trivy:
The Aqua Trivy-specific settings are just scan_type and policy_type. The rest of the settings are common to all scanners where the scan_type is container.
The following sections list the setting:value pairs for each provider.
All Scan Types
The following settings apply to all scanners.
scan_type- accepted values:
container,repository,instance,configuration.
- accepted values:
Repository Scan Type Settings
The following settings apply to all scanners where the scan_type is repository.
repository_project*repository_branch*
Container Scan Type Settings
The following settings apply to all scanners where the scan_type is container.
container_project*container_tag*container_type- accepted value(s):
local_image,docker_v2,jfrog_artifactory,aws_ecr- for
container_typeset tolocalNone
- for
container_typeset todocker_v2container_access_id: Usernamecontainer_access_token: Password/Token
- for
container_typeset tojfrog_artifactorycontainer_access_id: Usernamecontainer_access_token: Password/Token
- for
container_typeset toaws_ecrcontainer_access_id: Usernamecontainer_access_token: Password/Tokencontainer_region: Aws default region
- for
- accepted value(s):
container_domain
Instance Scan Type Settings
The following settings apply to all scanners where the scan_type is instance.
instance_identifier*instance_environment*instance_domaininstance_pathinstance_protocolinstance_portinstance_type- accepted value(s):
website
- accepted value(s):
Configuration Scan Type Settings
The following settings apply to all scanners where the scan_type is configuration.
configuration_type- accepted value(s)s:
aws_account
- accepted value(s)s:
configuration_regionconfiguration_environmentconfiguration_access_idconfiguration_access_token
Aqua Trivy
When product_name is set to aqua-trivy
scan_type- accepted value(s):
container
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
AWS Security Hub
When product_name is set to aws-security-hub
scan_type- accepted value(s):
configuration
- accepted value(s):
policy_type- accepted value(s):
manualUpload
- accepted value(s):
Bandit
When product_name is set to bandit
scan_type- accepted value(s):
repository
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
Black Duck Open Hub
When product_name is set to blackduckhub
scan_type- accepted value(s):
repository,container
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
- When
policy_typeis set toorchestratedScanproduct_domainproduct_auth_type- accepted value(s):
usernamePassword,apiKey
- accepted value(s):
product_access_id: api usernameproduct_access_tokenapi password or api keyproduct_api_versionproduct_project_nameproduct_project_version
Brakeman
When product_name is set to brakeman
scan_type- accepted value(s):
repository
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
Burp
When product_name is set to burp
scan_type- accepted value(s):
instance
- accepted value(s):
policy_type- accepted value(s):
manualUpload
- accepted value(s):
Checkmarx
When product_name is set to checkmarx
scan_type- accepted value(s):
repository
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,dataLoad,manualUpload
- accepted value(s):
- When
policy_typeis set toorchestratedScanordataLoadproduct_domainproduct_access_idproduct_access_tokenproduct_lookup_type- accepted value(s): Not Specified,
byName
- accepted value(s): Not Specified,
product_team_nameproduct_project_name
Data Theorem
When product_name is set to data-theorem
scan_type- accepted value(s):
repository
- accepted value(s):
policy_type- accepted value(s):
dataLoad,manualUpload
- accepted value(s):
- When
policy_typeis set todataLoadproduct_app_idproduct_access_token
Docker Content Trust (DCT)
When product_name is set to docker-content-trust
scan_type- accepted value(s):
container
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
Docker Content Trust (clair)
When product_name is set to docker-content-trust (clair)
scan_type- accepted value(s):
container
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
product_urlproduct_access_idproduct_access_token
External (JSON upload v2)
When product_name is set to external (json upload v2)
scan_type- accepted value(s):
container,repository,instance,configuration
- accepted value(s):
policy_type- accepted value(s):
manualUpload
- accepted value(s):
Fortify
When product_name is set to fortify
scan_type- accepted value(s):
repository
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
- When
policy_typeis set toorchestratedScanproduct_license_path: seecustomer_artifacts
Fortify on Demand
When product_name is set to fortifyondemand
scan_type- accepted value(s):
repository
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,dataLoad,manualUpload
- accepted value(s):
- When
policy_typeis set toorchestratedScanordataLoadproduct_domainproduct_access_idproduct_access_tokenproduct_owner_idproduct_entitlementproduct_scan_typeproduct_app_nameproduct_release_nameproduct_target_languageproduct_target_language_versionproduct_scan_settings- accepted values:
Custom,default
- accepted values:
product_audit_typeproduct_lookup_type- accepted values:
Dynamic,Static,Mobile
- accepted values:
product_data_center
Metasploit
When product_name is set to metasploit
scan_type- accepted value(s):
instance
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
Nessus
When product_name is set to nessus
scan_type- accepted value(s):
instance
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
- When
policy_typeis set toorchestratedScanproduct_domainproduct_access_idproduct_access_tokenproduct_policy_idproduct_scanner_idproduct_template_uuid
Nexus IQ
When product_name is set to nexusiq
scan_type- accepted value(s):
instance
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
- When
policy_typeis set toorchestratedScanproduct_domainproduct_access_idproduct_access_tokenproduct_organization_idproduct_project_nameproduct_lookup_type- accepted value(s):
byPrivateId,byPublicId
- accepted value(s):
- When
product_lookup_typeis set tobyPublicId- product_public_id
- When
product_lookup_typeis set tobyPrivateId- product_private_id
Nikto
When product_name is set to nikto
scan_type- accepted value(s):
instance
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
Nmap ("Network Mapper")
When product_name is set to nmap
scan_type- accepted value(s):
instance
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
OpenVAS
When product_name is set to openvas
scan_type- accepted value(s):
instance
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
product_domainproduct_access_idproduct_access_token
OWASP
When product_name is set to owasp
scan_type- accepted value(s):
repository
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
Prowler
When product_name is set to prowler
scan_type- accepted value(s):
repository
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
Qualys Web Application Scanning (WAS)
When product_name is set to qualys
scan_type- accepted value(s):
instance
- accepted value(s):
policy_type- accepted value(s):
manualUpload
- accepted value(s):
Reapsaw
When product_name is set to reapsaw
scan_type- accepted value(s):
repository
- accepted value(s):
policy_type- accepted value(s):
manualUpload
- accepted value(s):
ScoutSuite
When product_name is set to scoutsuite (aws only)
scan_type- accepted value(s):
configuration
- accepted value(s):
policy_type- accepted value(s):
manualUpload
- accepted value(s):
ShiftLeft
When product_name is set to shiftleft
scan_type- accepted value(s):
repository
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,dataLoad,manualUpload
- accepted value(s):
- When
policy_typeis set toorchestratedScanordataLoadproduct_access_idproduct_access_tokenproduct_app_nameproduct_target_language
Sniper
When product_name is set to sniper
scan_type- accepted value(s):
instance
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
Snyk
When product_name is set to snyk
scan_type- accepted value(s):
container
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
product_access_token
SonarQube SonarScanner
When product_name is set to sonarqube
scan_type- accepted value(s):
repository
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,dataLoad,manualUpload
- accepted value(s):
- When
policy_typeis set toorchestratedScanordataLoadproduct_domainproduct_access_tokenproduct_lookup_typeproduct_project_nameproduct_project_keyproduct_excludeproduct_java_binariesproduct_java_libraries
Tenable.io
When product_name is set to tenableio
scan_type- accepted value(s):
instance
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,dataLoad,manualUpload
- accepted value(s):
- When
policy_typeis set toorchestratedScanordataLoadproduct_domainproduct_access_idproduct_access_tokenproduct_policy_idproduct_scanner_idproduct_template_uuid
Prisma Cloud (formerly Twistlock)
When product_name is set to twistlock
scan_type- accepted value(s):
container
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,dataLoad,manualUpload
- accepted value(s):
- When
policy_typeis set toorchestratedScanordataLoadproduct_image_nameproduct_domainproduct_access_idproduct_access_token
Veracode
When product_name is set to veracode
scan_type- accepted value(s):
repository
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,dataLoad,manualUpload
- accepted value(s):
product_auth_type- accepted value(s): ['usernamePassword', 'apiKey']
product_access_id: username / keyIdproduct_access_token: password / keyproduct_app_idproduct_project_name
WhiteSource
When product_name is set to whitesource
scan_type- accepted value(s):
repository
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
- When
policy_typeis set toorchestratedScanproduct_domainproduct_access_idproduct_access_tokenproduct_includeproduct_excludeproduct_lookup_type- accepted value(s): Not Set,
byName,byTokens,appendToProductByToken,appendToProductByName
- accepted value(s): Not Set,
product_product_nameproduct_project_nameproduct_product_tokenproduct_project_token
JFrog Xray
When product_name is set to xray
scan_type- accepted value(s):
container
- accepted value(s):
policy_type- accepted value(s):
manualUpload
- accepted value(s):
Zed Attack Proxy (ZAP)
When product_name is set to zap
scan_type- accepted value(s):
instance
- accepted value(s):
policy_type- accepted value(s):
orchestratedScan,manualUpload
- accepted value(s):
- When
policy_typeis set toorchestratedScanproduct_context_name: seecustomer_artifacts