Absent Member.
Absent Member.
5516 views

SonarCube plugin & Fortify

Is there any integration/Fortify plugin available for SonarCube?

-> If YES, the license to use is the same used by the Eclipse plugin, for example?

Thank you in advance,

Marcelo Muzilli

Labels (1)
0 Likes
4 Replies
Absent Member.
Absent Member.

Yes there is. I'm using Sonar to manage findings instead of SSC. You do loose some functionality that SSC has

Fortify Plugin (1.x) - SonarQube - Codehaus

0 Likes
Commodore
Commodore

Also a soon-to-be option is using ThreadFix. You can either load FPRs into ThreadFix or use the SSC connector. Our entire org puts static, dynamic, other appsec tool outputs, and manual findings into ThreadFix for every application we test.

Denim Group has built a ThreadFix plugin for Sonar which should be out really soon. So your SonarQube dashboard can have quality metrics for ALL of your security tools, not just Fortify.

0 Likes
Commodore Commodore
Commodore

Anyone ever used ThreadFix in conjuction with things like WhiteHat?  One of our biggest issues is trying to get WhiteHat, FoD, Fortify, etc... all in one place so we can have a great security picture.

Thanks,

Mike

0 Likes
Absent Member.
Absent Member.

Any updates in feeding Fortify SCA results to ThreadFix for SonarCube results review?
http://docs.sonarqube.org/display/PLUG/Fortify+Plugin

Like , looking into a Proof Of Concept to have our static and dynamic security scanner result types that are supported by ThreadFix to feed into SonarCube for build pass/fail.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.