Using Maven

CI/CD Integration - Using Maven

Before scanning applications using IZ Scan, make sure you have:

Purchased a valid license for IZ Scan.
Downloaded and installed Apache Maven 3.6.3 or higher. Refer to Installing Apache Maven
Downloaded and installed JDK 11
Follow the instructions on Generating Security Token to generate a security token

Adding Repositories

The binaries required to scan the projects are available in IZ Maven Central repository. Include the following repositories and plugin repositories in settings.xml

<repositories>
    <repository>
        <id>iz-maven-repo</id>
        <name>IZ Maven Repo</name>
        <url>https://iz-public-m2.s3.eu-west-2.amazonaws.com/releases</url>
    </repository>
</repositories>

<pluginRepositories>
    <pluginRepository>
        <id>iz-maven-plugin-repo</id>
        <url>https://iz-public-m2.s3.eu-west-2.amazonaws.com/releases</url>
    </pluginRepository>
</pluginRepositories>

CI/CD Integration

Go to the project root directory from the command line/terminal
Run mvn com.integralzone.izsuite:iz-scan-cli:scan command with the following options

The maven command prior to version 26.3.1 will be mvn com.integralzone.falcon:falcon-scan-cli:scan . Rest of the parameters will remain the same.

-DserviceHost=xxx IZ Scan service URL
-DauthToken=xxx Security token generated from the server
-DapplicationKey=x.x Unique ID of the application / project being scanned
-DapplicationName=. Name of the application being scanned
-Dsource=xxx Optional. Location of the project source directory. If ignored, the current directory will be used as the project source directory
-DscmBranchName=xxx + Optional. SCM branch for which code is being analyzed. If ignored, the default value will be master
-DpullRequestId=xxx + _Optional.SCM Pull request name for which code is being analyzed
-Dorganization=xxx + Optional. Organization under which the project should be categorized. If ignored, the default organization will be used. Value can be any of Organization Name / Id / Ext Id. NOTE: In a multi tenancy environment, this parameter is mandatory.
-DsarifReport=xxx + _Optional. Used to generate issues in SARIF format. The output report file path must be specified using this parameter.

Please refer to the section below for instructions on how to retrieve the organization ID.

A complete example may look like

PROJECT_ROOT_DIR> mvn com.integralzone.iz:iz-scan-cli:scan 
-DserviceHost=${FALCON_HOST} 
-DauthToken=${FALCON_TOKEN} 
-DapplicationKey=orders-sapi 
-Dsource=.
-DapplicationName="Orders SAPI"

Retrieve Organization ID

Navigate to the main menu Organizations -> Organizations
In the displayed list of organizations, each one will have an associated Id as shown below.

Use the Organization ID when performing the CICD scan with the -Dorganization parameter.

_For example: -Dorganization=cm0oy5hht00efv640wm935np9_

Setting Proxy Details

If the system from which the projects are analyzed is configured with a proxy, then set the following arguments with proxy server details -

Windows

-Dhttps.proxyHost=PROXY_HOST -Dhttps.proxyPort=PROXY_PORT -Dhttp.proxyHost=PROXY_HOST -Dhttp.proxyPort=PROXY_PORT -Djava.net.useSystemProxies=true

Replace PROXY_HOST and PROXY_PORT with appropriate values for Porxy server host and port
If https.proxyPort is not specified default value will be 443
If http.proxyPort is not specified default value will be 80