This can be done. First, you need to download the latest application file from the Artifacts section of the app version in SSC. (Click on either the "Application File" or "Application & Sources" button.) This file will include the results from the last scan, custom issue template assigned to the app version, and audits. When you run the next local scan, make the filename specified in the argument of the "-f" option in the sourceanalyzer scan command the same as the FPR you downloaded from SSC.

To automate the download, I recommend you use the fcli tool. With fcli, the command you need is:

fcli ssc av download-state -f sample.fpr 10068

(Note: "10068" is a sample app version ID. Replace it with the ID from your own app version.)

Once the FPR has been downloaded, run the sourceanalyzer scan command. For example:

sourceanalyzer -b build_id -logfile scan.log -scan -f sample.fpr

Hope this helps.

Thank you very much.

I tried this and it works as expected. One question though is how I can have FPRUtility ignore issues with tags like "Not an issue". At present, I have 6 critical issues and have suppressed one and marked another one as "Not an issue". I would like to see FPRUtility report only 4 critical issues locally but it is reporting 5.

Also out of curiosity, it seems like we can use -merge option in FPRUtiity to achieve the same result but wondering what the difference between fcli and merge option and which would be best suited for this approach.

To help you formulate the correct search string, I recommend you use Audit Workbench (AWB). Here's an animated GIF that shows you how:

(You may want to open the image in new tab to view the full resolution.) Once you have the search string, copy/paste it into your FPRUtility command:

FPRUtility -information -search -query "[fortify priority order]:critical AND Analysis:!not an issue" -project WebGoat_v2023.8_2024-09-04.fpr

Regarding your last question, yes, you can use the FPRUtility -merge option to "merge" two FPR files. The sourceanalyzer command in my last reply does the same thing (if the FPR file specified in the argument of the "-f" option already exists). You could have specified a different filename in the sourceanalyzer scan command, and then followed it up with an FPRUtility -merge command. Note that the fcli command in my last reply only downloaded the FPR file from SSC; fcli does not possess merge functionality.

Hope this helps.