availability

Package: Invicti AppSec Enterprise (on-premise, on-demand)

Coverity SAST

Invicti AppSec supports Coverity (Synopsys Polaris) as a SAST (Static Application Security Testing) scanner. This guide explains how to activate and configure the Coverity integration.

Coverity is a language agnostic SAST tool, meaning it supports a wide range of programming languages.

Prerequisites

Before starting the integration, ensure you have the following information from your Coverity (Polaris) instance:

Field	Description	Required
Token	API access token generated from your Coverity/Polaris account	Yes
URL	Your Coverity/Polaris instance URL (e.g., https://<your-org>.polaris.synopsys.com)	Yes
Instance	Instance name (defaults to "Default")	No
Insecure	Skip SSL certificate verification (not recommended for production)	No

Get a Token (on Coverity/Polaris Side)

1. Go to your profile by clicking on your username (upper left-hand corner).
2. Click on Access Tokens.
3. Click on Create New Token.
4. Enter a token name and save.

Step 1: Navigate to Integrations

From the left sidebar menu, click on Integrations.

Step 2: Select the SAST Tab

On the Integrations page, you will see the Scanners section with multiple tabs. Click on the SAST tab (it is selected by default).

     

Step 3: Find and Activate Coverity

Scroll through the list of SAST scanners to find Coverity.

• If Coverity is not activated, you will see an "Activate" button. Click it to enable the integration.
• If Coverity is already activated, you will see a toggle switch in the ON position and a "Deactivate" button, along with a gear icon for configuration.

info

The scan method badge on the Coverity card shows KDT, which means scans are triggered through the Kondukto CLI tool (KDT).

Step 4: Configure Connection Settings

Click on the gear icon on the Coverity card to open the configuration panel. Fill in the required fields:

1. Instance: Select or create an instance name from the dropdown. Use "Default" if you have a single Coverity instance.
2. Token: Paste the API access token you generated from Coverity/Polaris.
3. URL: Enter your Coverity/Polaris instance URL (e.g., https://<your-org>.polaris.synopsys.com).
4. Insecure: Enable this checkbox only if your Coverity instance uses a self-signed SSL certificate.

  

Step 5: Test the Connection

Click the "Test Connection" button at the bottom of the configuration panel to verify that the provided credentials and URL are correct.

• If the connection is successful, the integration is ready to use.
• If the connection fails, verify your Token and URL values.
• For existing integrations, you can use the "Retest Connection" button at the top of the panel.

Step 6: Advanced Settings (Optional)

Click on "Advanced Settings" to expand additional options:

Setting	Description	Default
Allow team leads to scan this instance	Permits team leads to trigger scans using this Coverity instance	Off
Allow team leads to create new instances	Permits team leads to create additional Coverity instances	Off

After modifying advanced settings, click "Save Advanced Settings" to apply changes.

  

Summary

Step	Action
1	Navigate to Integrations from the sidebar
2	Select the SAST tab under Scanners
3	Find Coverity and click Activate (if not already active)
4	Click the gear icon and fill in Token, URL, and optionally Instance
5	Click Test Connection to verify
6	(Optional) Configure Advanced Settings for team lead permissions

Create a Scan

After activating and configuring Coverity, you can create scans from your project's scanner settings.

Navigate to Project Scanners

1. Go to your Project page.
2. Click on the Settings tab.
3. Select Scanners from the left sidebar.

Add Coverity Scanner

1. In the scanner type dropdown, select SAST.
2. In the scanner dropdown, search for and select Coverity.
3. Click the Add button to open the scan configuration drawer.

  

Scan Configuration Fields

Field	Description	Required
Environment	Select the environment for the scan (optional)	No
Project	Select the Coverity/Polaris project to bind to	Yes
Coverity Branch	Select the Coverity branch for the scan	No
Branch	Specify the branch to scan	No
Meta Data	Additional metadata for the scan (optional)	No
Scan Tag	Tag to identify the scan (optional)	No
Retrieve Code Snippet	Enable to retrieve code snippets from scan results	No
Fork Default Branch	Enable to fork the default branch before scanning	No

Scheduler

• Now: Run the scan immediately after saving.
• Custom Date: Schedule the scan for a specific date and time.

Webhook (Optional)

Enable webhook to trigger scans via actions taken on your application lifecycle management tool:

1. Check the Trigger scans via actions checkbox.
2. Select the Platform (e.g., GitHub, GitLab, Bitbucket).
3. Click Generate to create a Secret Key for webhook authentication.

KDT Command

You can also trigger Coverity scans from your CI/CD pipeline using KDT:

kdt scan -p <project_name> -t coverity -b <branch_name>

Click Save to create the scan configuration.

Troubleshooting

Connection Fails

• Invalid Token: Ensure the Polaris access token is correct and has not expired. Generate a new token from the Polaris portal.
• Incorrect URL: Verify the URL matches your Polaris instance (e.g., https://<your-org>.polaris.synopsys.com).
• SSL Certificate Issues: Enable the Insecure checkbox if your Polaris instance uses a self-signed certificate.
• Network/Firewall: Ensure the Invicti AppSec instance can reach the Polaris API endpoint.

Scan Issues

• No Projects Found: Verify the token has sufficient permissions to list projects in Polaris.
• Branch Not Found: Ensure the specified branch has been analyzed in Coverity/Polaris before importing.
• Empty Results: Confirm that the Coverity analysis has completed successfully on the Polaris side.

Best Practices

• Use Dedicated Access Tokens: Create a dedicated Polaris access token for the Invicti AppSec integration.
• Rotate Tokens Regularly: Regenerate access tokens periodically as part of your security practices.
• Use HTTPS: Always use HTTPS for the Polaris URL.
• Enable Code Snippets: Enable the Retrieve Code Snippet option to provide developers with more context for remediation.

Limitations

• Cloud-Based: Coverity (Polaris) is a cloud-based service. For on-premise Coverity, use the Coverity Server integration.
• Token Expiration: Polaris access tokens may have expiration policies. Check your organization's token management settings.
• Project Binding: Each scan configuration in Invicti AppSec is bound to a specific Coverity/Polaris project.

---

Need help?

Invicti Support team is ready to provide you with technical help. Go to Help Center