Configuring Strobes SAST

Overview

This article explains how to configure the Strobes SAST connector within the platform. By using Strobes SAST, you can invoke static application security scans directly from Strobes, ingest and prioritize the resulting vulnerabilities, and manage remediation workflows through a centralized application security interface.

Prerequisites

1. Access to the Connectors section in Strobes
2. Owner/Manager role in your Strobes Account.
3. Source code hosted in:
4. 1. Git
   2. GitHub
   3. Azure Repos
   4. Bitbucket
4. Required repository access permissions

Step 1: Access Strobes SAST Connector

1. Log in to Strobes.
   
2. Navigate to Connectors.
   
   
3. Select Static Security Scanners.
   
   
4. Search for Strobes SAST.
   
   
5. Click on Strobes SAST to start creating a workflow.

Step 2: Create a Strobes SAST Configuration (Step One – Configuration Details)

1. Enter a Configuration Name. (Any name for your identification)
   Click Next.

Step 3: Select Version Control System

(Step Two – Git Config, Asset Selection & Scheduling)

Choose the version control system where your source code is hosted:

• Git
• GitHub
• Azure Repos
• Bitbucket
• Svn

The configuration steps differ slightly based on the selected option.

Use Git Configuration in Strobes SAST

1. Select Git as the Version Control System.
2. Choose the Git configuration created earlier.

Assets (Git-specific)

• When Git is selected, the Assets field is mandatory.
• The selected asset represents the application or service being scanned.
• All Strobes SAST findings will be mapped to this selected asset.

B. GitHub Configuration

Select GitHub

1. In the Bandit configuration screen, select GitHub.
2. Under Select GitHub Credential, choose an existing credential.

Create GitHub Credentials (If Not Available)

1. Click Create Credential.
2. Enter a Name for the credential.
3. OAuth authentication is triggered automatically.
4. After successful authentication, the credential is added.

Choose Repositories

1. Select the GitHub credential.
2. Click Choose Repositories.
   
3. The repository list opens:
4. • All repositories are selected by default.
   • Users can:
   • • Select or deselect repositories
     • Bulk select or unselect
     • Search repositories
     • Refresh the repository list
     • Scroll to view all repositories
4. Click Save after selecting the required repositories.

Asset Mapping (GitHub)

• For GitHub, there is no separate Asset field.
• Each selected repository automatically becomes an asset.
• Findings are imported against the respective repository.

C. Azure Repos Configuration

Select Azure Repos

1. In the Strobes SAST configuration screen, select Azure Repos.
2. Under Select Azure Repos Credential, choose an existing credential.

Create Azure Repos Credentials (If Not Available)

1. Click Create Credential.
2. Enter a Name for the credential.
3. OAuth authentication with Azure DevOps is initiated.
4. After successful authentication, the credential is added.

Choose Repositories

1. Select the Azure Repos credential.
2. Click Choose Repositories.
3. The repository list opens:
4. • All accessible Azure repositories are selected by default.
   • Users can:
   • • Select or deselect repositories
     • Bulk select or unselect
     • Search repositories
     • Refresh the repository list
     • Scroll through the repository list

Click Save after selecting the required repositories.

Asset Mapping (Azure Repos)

• There is no Asset field when Azure Repos is selected.
• Each selected Azure repository becomes an asset.
• Findings are imported and mapped to the respective repository.

D. Bitbucket Configuration

Select Bitbucket

1. In the Bandit configuration screen, select Bitbucket.
2. Under Select Bitbucket Credential, choose an existing credential.

Create Bitbucket Credentials (If Not Available)

1. Click Create Credential.
2. Enter a Name for the credential.
3. OAuth authentication with Bitbucket is initiated.
4. After successful authentication, the credential is added.

Choose Repositories

1. Select the Bitbucket credential.
2. Click Choose Repositories.
3. The repository list opens:
4. • All repositories are selected by default.
   • Users can:
   • • Select or deselect repositories
     • Bulk select or unselect
     • Search repositories
     • Refresh the repository list
     • Scroll to view all repositories
4. Click Save after selecting the required repositories.

Asset Mapping (Bitbucket)

• There is no Asset field for Bitbucket.
• Selected repositories automatically act as assets.
• Findings are mapped directly to the respective repositories.

Step 4: Additional Scan Settings

Agents

• Select the required Agents to execute the scan.
  

Smart Auto-closure of Findings

• Enable to automatically close findings when issues are fixed.
• Disable to manage closures manually.

Scan Scheduling

Choose one of the following:

• Don’t Schedule
• Daily
• Weekly
• Monthly
  

Step 5: Tracking & Notifications (Optional)

Users can configure integrations with:

• GitHub Issues
• Azure Boards
• Jira
• Bugzilla
• Email
• MS Teams

These integrations help push findings to ticketing systems and notify teams.

Step 6: Complete Configuration

• Review the configuration.
• Click Submit.
• The Strobes SAST workflow is created successfully.
  

Step 7: Run the Scan

1. Open the Strobes SAST workflow.
2. Manual Scan (When “Don’t Schedule” Is Selected)
3. Click New Scan.
4. A scan configuration popup opens.

5. Enter the Branch name.
6. Click Scan to start.
7. The scan starts on the selected repositories.
   

Aborting a Running Scan

• While a scan is running, users can abort it from the scan details page.
• Aborting stops the current scan execution.
• Users can initiate a new scan once ready.

Note: Aborting a scan does not impact results from completed scans.

Editing or Deleting a Bandit Configuration

1. Open the Strobes SAST workflow.
2. Navigate to the Settings tab.
3. From this page, users can:
4. • Edit the configuration
     
   • Delete the configuration
     

View Scan Results

• Scan results are available in the Findings section.
• Findings are mapped to:
• • Selected Assets (Git), or
  • Selected Repositories (GitHub, Azure Repos, Bitbucket).