Ingest Veracode Data

You can ingest SAST findings directly from Veracode into Prisma Cloud. This allows you to use Prisma Cloud Application Security’s analysis and visualization tools to identify critical vulnerabilities, prioritize remediation efforts, and improve your application code security.

How to connect Veracode with Prisma Cloud

1. Before you begin.

   1. Activate at least one CAS module that includes version control system (VCS) and repository integrations.
   2. Generate and copy a Veracode access key to enable access to Prisma Cloud. The access key includes a key ID and secret.
   3. Add the Prisma Cloud IP addresses and hostname for Application Security to Vercode’s allow list to enable access to the Prisma Cloud console.

      If you have default Veracode settings you do not need to add the Prisma Cloud IP addresses to your allow list.
   4. Grant the user integrating Veracode with the following permissions:

      • In Prisma Cloud: 'System Admin', 'AppSec Admin' or GRBAC permissions
      • In Veracode: A minimum of 'Reviewer' permissions is required
2. Under Application Security, select Settings > Connect Provider > Code & Build Providers.
3. Select Veracode under the '3rd Party Ingestion' section in the catalog.
4. On the Configure Integration step of the integration wizard.

   1. Fill in the provided fields:

      • Enter the Veracode key ID and secret from step 1b into their respective fields
      • Select your Veracode region from the Region dropdown
   2. Click Authorize.
5. On the Select Applications step of the integration wizard.

   1. Select which Veracode applications will be scanned:

      • All current applications
      • All current and future applications (This is the recommended option to ensure complete coverage and successful operation of all features)
      • Only selected applications > select the applications from the menu that is displayed
   2. Click Next.

      'Applications' in Veracode and 'Repositories' in Prisma Cloud are identical artifacts.
6. On the Map to Repositories step of the wizard.

   1. Select an option:

      • Accept the displayed mapping as detected by Prisma Cloud. This does not require any action on your part
      • Manually configure mapping if Prisma Cloud could not match a project to a repository: Select Set in the Prisma Cloud Repository column, and select a repository from the list that is displayed
      • Reject mapping: Select the Don’t map any applications box
      • Manually modify mapping: Select Replace next to the existing mapped Prisma Cloud repository. This will open an option to select a different repository from the displayed list, allowing you to update the mapping

        Mapping establishes relationships between Veracode projects and Prisma Cloud code repositories, simplifying access management and enabling risk analysis at the repository level, including displaying findings on the Prisma Cloud console.
   2. Select Next.
7. Select Done on the Status step of the wizard to complete the integration, initiating an automatic ingestion of data from the integrated Veracode projects.

Verify Integration

1. On Application Security select Settings > 3rd Party Ingestion.
2. Verify that the status of the relevant Veracode project is listed as Connected.

   'Veracode project' in step 2 above refers to a Veracode application. Periodic scans for Prisma Cloud scanners will not fail if 3rd party ingestion fails.

Manage Connections

Manage integrations on the console from the Providers page under Settings.

1. On Application Security select Settings > 3rd Party Ingestion.
2. Select an action under the Actions column of a project:

   • Reselect Applications: Redirects to the Select Application step of the integration wizard, allowing you to manage selected applications
   • Change Mapping: Redirects to the Map to Repositories step of the wizard, allowing you to manage mapping
   • Delete Application: Deletes the application. Mapped repositories will be deleted accordingly. This option is available only if 'All current and future applications' is not selected
   • Delete Entire Integration: Deletes the integration

Manage CWE Weaknesses

To view and manage CWE weaknesses from ingested Veracode findings, refer to Manage Third-Party Ingested Data.

Limitations

• The current Veracode SAST ingestion supports Veracode periodic and CLI scans. Pull Request scans and other types are not supported
• History, deduplication and DevEx features such as PR comments, IDE integration and enforcement are not supported