Integration with BlackDuck SCA

This article covers the steps required to integrate your Phoenix Security account with BlackDuck.

Prerequisites

– In order to create a new scanner integration you should have access to the platform as an Org Admin user.
– To connect your account to BlackDuck you need to have the required Base URL, API Access Token (see below).

BlackDuck API Credentials

To integrate with the BlackDuck API you need a valid API Access Token. In order to generate one, please follow the instructions below, or this link.

1. From the user menu located on the top navigation bar, select My Access Tokens. The My Access Tokens page appears.
2. Click Create New Token. The Create New Token dialog box appears.
   

3. Type a name in the Name field.
4. Optional: In the Description field, type a description or definition.
5. Select Read Access.
6. Click Create. The API token displays in a pop-up window. For security reasons, this is the only time your user API token displays. Please save this token. If the token is lost, you must regenerate it.
7. Optional: To modify an access token that you created, click the arrow in the same row as the access token name to open a drop-down menu and select Edit, Delete, or Regenerate.

Create a BlackDuck Integration

1. On the sidebar menu, navigate to the Scanners tab in the Integrations section.

2. Move over the BlackDuck block under SCA/FOSS and click the “add” icon (if you already have an integration you can click on the context menu “…” and select Create New Integration.

3. On the second step you need to provide the required details for the scanner integration. In the case of BlackDuck you need to provide:

• Name: The name for this integration.
• Server URL: This is the Base URL for you BlackDuck Hub portal.
• API Key: This is the API Access Token generated in the previous steps.

5. In the next step you will be able to select whether the platform fetches all the assets and vulnerabilities available form the scanner, or you can include/exclude individual “targets” (applications, project, etc), if supported by the scanner.

6. To finish the configuration click on “Create Scanner“.

Unless there are issues with the credentials, the new scanner will appear in your list of integrations (under Integrations > Scanners) and the platform will start to collect asset and vulnerability details from all Subscriptions available through the integration credentials.

All the scanner’s assets and vulnerabilities will be automatically added to your account’s Default Application, and will be available to start assigning them to user-created Applications as required.