# Scan a Github/Gitlab {% embed url="" %} ### Prerequisites * You must have a valid Github/Gitlab/Azure account ### 1. Github/Gitlab Cloud #### **Step 1: Sign in or Integrate Github/Gitlab** Sign in with Github or Gitlab (or integrate them from the integration page if you are signing up by email or with any other IDP)

**Step 2: Scan Repositories** If you are logged in with a GitHub/Gitlab account or integrate the accounts, it will redirect you to the Github/Gitlab Scan Page where you will see all of your repositories (both public and private). You can select any repository (or multiple) and run the scans.

#### **Step 3: Scan any public repository.** You can scan any public Github or Gitlab repository using the input form (check below). Scan your public GitLab repositories in the marked option

### **2. Github/Gitlab Enterprise** #### **Step 1:** Contact CD Support to enable By default, the option for Github/Gitlab enterprise is disabled. You need to contact CloudDefense support at to enable the option. Please email us with these details: * Organization Name * Account email address

#### How to Get GitHub Enterprise link and Generate Access Token: 1. **Enterprise Token:** To integrate GitHub enterprise users must have an enterprise account. If the user have an enterprise account user can see all enterprises here

Clicking on the enterprise user will get an enterprise link. If the user doesn't have a GitHub enterprise, the user can easily open an enterprise account from the link below. 2\. **Access token** To integrate GitHub enterprise users need access tokens. To find the access token user need to go to **Setting > tokens** Here is the URL :

After creating an access token, the user must copy and paste it into the enterprise access token field.

#### **Step 2: Configure** Once your account is ready for integration, you will see the options to provide details as below: 1. Enterprise Link 2. Enterprise Access Token of Github and Gitlab

#### How to Get **Gitlab** Enterprise link and Generate Access Token: 1. **Enterprise link :** To integrate Gitlab enterprise users must have an enterprise account. If the user have an enterprise account user can see all enterprises/groups here

Clicking on the enterprise user will get an enterprise link. If the user doesn't have any Gitlab enterprise, the user can easily open an enterprise account from the link below. **2. Access token:** To integrate Gitlab enterprise users need access tokens. To find access token user need to go from profile dropdown Preference > Access token

Here is the **URL** : After creating the access token users need to copy that and paste it to the enterprise access token field. Once you provide the required information, click **configure.** # Scan an Azure DevOps repository {% embed url="" %} ### **How to integrate Azure Repository** To integrate Azure Repositories with Cloud Defense, please follow the mentioned guidelines. ### Prerequisites Users must have an existing Azure account, which requires : * Azure Username * Azure Personal Access Token * Azure Organization Name * Azure Project Name ### **Instructions** ### **Step 1:** **Select Azure Repos Integration** Please select the Integration Page from your CloudDefense Dashboard and click on Azure Repos.

### **Step 2:** **Fill Up the Azure Integration Form** Then you will see the Azure integration form which requires username and account token details and configures the repos accordingly.

Now fill up the form with all the required information. Check the screenshot below.

**Important**: Make sure to check the “Full Access” for Scope.

Now fill up the form with all the required information. Check the screenshot below.

### **Step 3: Configure "Azure Repos"** Once you are done, please click **"CONFIGURE."**

Now you can see all of your Azure Repos and start scanning as shown in the following screenshot.

# Scan a Bitbucket repository {% embed url="" %} To integrate Bitbucket Repositories with Cloud Defense, please follow the mentioned guidelines. ### Prerequisites * Users must have an existing Bitbucket account, which requires: Bitbucket Credentials ### Instructions ### Step 1: Select Bitbucket Repos Integration Please select the Integration Page from your CloudDefense Dashboard and click on **Bitbucket**.

### Step 2: Click Configure and connect the account Once you are here, hit **Configure**.

### Step 3: Scan "Bitbucket Repos" Once you are done, please click "Scan Application."

Now you can see all of your Bitbucket Repos and start scanning as shown in the following screenshot.

### How to integrate Bitbucket Server? To integrate Bitbucket Server Repositories with Cloud Defense, please follow the mentioned guidelines. ### Prerequisites Users must have an existing Bitbucket Server, which requires : Bitbucket server Credentials ### Instructions #### Step 1: Select Bitbucket Server Integration from Source control Please select the Integration Page from your CloudDefense Dashboard and click on Bitbucket Server

#### Step 2: Fill up your credentials in the input field In the input field “Give the host link” you need to provide your server host link and from Bitbucket Server you will get your access token, you need to provide that in “Enter your access token”

**-- How to give the host link?** Your bitbucket server link will be the host link for the input field. Here is a sample host link

**-- How to get your access token?**

* After login to your Bitbucket server account, click on “Manage account” from your profile upper right side corner

* For creating access token click on “HTTP access Token” and click on “Create token”

* After clicking on “Create token” you will be able to see a token creation form, put a token name and click on the “create” button. Your token will be created. N.B : After creating your access token you just copy that token one time. After continuing you will not be able to view this token again. #### Step 3: Click Configure and connect the account After providing all information, click the configure button. It will automatically connect it to the Bitbucket server and show this screen.

#### Step 4: Scan "Bitbucket Server Repos" Once you are done, please click "Scan Application." and you will see your server's entire repository. You can easily select each or all your repositories and start scanning.

# Written code Scan (SAST) {% embed url="" %} #### **For SAST Scans users need to follow the mentioned steps.** We can start an online scan by clicking on the **SCAN** button on top right

We chose **Github** for this example. Once clicked, you get a repo to scan. For the demonstration purpose we take **Vulnado.**

We clone the repo and paste it like,

Hit the green plus sign and scan.

Scan with start

Once online scans finishes we get the result like following

Above picture shows that we scanned a project names “vulnado-test” which has our Code Analysis (SAST) and other scans. Let’s dive into that. Once you click on it you will be redirected to a page like following Which will contain the following information about your SAST scan ``` 1) Project Scanned ``` Named of our current project. In this case vulnado-test ``` 2) Scan Date ``` When scan was performed, on which date and at what time ``` 3) User’s Email ``` Which user performed this scan? We show their email address ``` 4) RuleId ``` Which rules matched our sets of backend rules. We show that ``` 5) Vulnerable Code Snippet ``` Code block which is vulnerable ``` 6) Rule description ``` More information about the ruleid ``` 7) File Path ``` Vulnerable code file path ``` 8) Filter Severity - To filter your results based upon the criticality ``` # Open Source Libraries Scan (SCA) {% embed url="" %} ### Starting Scan We can start an online scan by clicking on the **SCAN** button on top right

We choose Github for this example. Once clicked get a repo to scan. For the demonstration purpose we take **Vulnado.**

We clone the repo and paste it like,

Hit the green plus sign and scan

Scan with start

Once online scans finishes we get the result like following

Above picture shows that we scanned a project names “vulnado-test” which has our pom.xml (SCA JAVA) and other scans. Let’s dive into that. Once you click on it you will be redirected to a page like following

Which will contain the following information about your SAST scan ``` 1) Project Scanned ``` Named of our current project. In this case vulnado-test ``` 2) Scan Date ``` When scan was performed on which date and at what time ``` 3) User’s Email ``` Which user performed this scan, we show their email address ``` 4) RuleId ``` Which rule matched our sets of backend rules. We show that ``` 5) Vulnerable Depedency ``` Vulnerable dependencies with exact verion ``` 6)Description of CVE ``` More information about the vulnerability that dependency have ``` 7) Patch ``` How to fix that issue ``` 8) Filter Severity - To filter your results based upon the criticality ``` Once sca scan is done, we can patch the vulnerable dependencies directly from UI if Source Control (Github/ Gitlab/ Bitbucket) is configured and you know that repo. # Secrets Scan {% embed url="" %} ### **Prerequisite** * Clouddefense CLI * Gitleaks ### Steps To scan for secrets we need to pass “--no-git” flag from the CLI like, ``` // Some codecdefense full --api-key=6262fe7f-1434-2711-78fa-268ce4187339 --path=/opt/secretsandstuff --project-name=leaks --no-git ``` In the above command we pass our api-key, with the project path to scan and –no-git to include secret scans. Once scans finish we can look the data in UI

And once expanded ,we can see our data

# DAST Scans Dynamic application security testing (DAST) is a process of testing an operating application or software product in order to identify potential security vulnerabilities and architectural weaknesses. {% embed url="" %} ### DAST Scan or Website Scan from CloudDefense UI In DAST scan we provide a website address for example and DAST scanner will check for vulnerabilities on the provided target.To Start a new DAST Scan from UI follow below steps: #### Step 1 : Login Cloud Defense console instance Please login to your Cloud Defense by clicking [**here**](https://console.clouddefenseai.com/) #### Step 2: Click on “Scan” on top and then select “Other”

#### Step 3: After clicking on “Other” select “DAST”

**Step 4: Now you can run a simple scan by just providing Resource URL**

If you want more control over your scanning configuration and features then you can use **“Advanced options”**

1. **Resource URL** - Provide target address, example: ; 2. **Login URL** - Page where we can submit login credentials for example ; 3. **Submit field** - Name of Submit field which needs to be clicked automatically 4. **Username** - This could be email, phone, username value which you use 5. **Username field** - This is input field username’s name 6. **Password** - This is part of your credential value 7. **Password field** - This is input field password’s name 8. **Proxy Host** - If your website is behind VPN and you have Proxy VPN Credentials for that, then provide Host from that credential 9. **Proxy Port** - Provide Port number from your VPN Credentials 10. **Scan Type** - a) **Website Scan** - This is the fastest scan and it scans websites without sending a lot of requests to perform tests, you can also call it light-weight scan. b) **Deep scan** - This scan takes more time and sends a lot of requests to perform different kinds of vulnerability checks. ### DAST Scan from CLI 1. Install cdefense CLI in your Device using these steps - ; 2. Now run below command to run DAST Scan from CLI `cdefense dast --api-key= --url=https://website.com --project-name=example-website-scan --scan-type="full" --verbose` \ \ \ \ \ \ \
# API Scan from CloudDefense UI We support only swagger endpoints for API Scans for now, so if you have any APIs which aren't in swagger, we request you to create a swagger file using those APIs. To run API Scans follow these steps {% embed url="" %} ### Step 1: Access to API application Login to your CloudDefense Instance and click on “Scan” then “Other”. After this select “API”\ \

### Step 2: Provide Swagger Details

We’ll use `https://petstore.swagger.io/v2/swagger.json` for testing here (Remember we need json as output not any html website, there is difference between swagger viewer and swagger json) In App URL you need to provide (Base URL) example - `https://petstore.swagger.io/` In JSON Path provide full URL of JSON - `https://petstore.swagger.io/v2/swagger.json` ### Step 3: Scan your API Key Then click on “Run Scan” and your scan should start. API Scan from CloudDefense CLI guidelines are given below: **a)** Install cdefense CLI in your Device using these steps - `https://github.com/CloudDefenseAI/cd#installation` **b)** Now run below command to run DAST Scan from CLI `cdefense api --api-key= --url=https://petstore.swagger.io/ --openapi-jsonurl=https://petstore.swagger.io/v2/swagger.json --project-name=example-api-scan --verbose`\ \ \ \ \ \
# GitHub Enterprise Actions {% embed url="" %} ### **Step 1:** Setting up runners GitHub enterprise needs “self-hosted” runners to support action system calls if needed. For our actions, we need to host a Linux VM that we listen to for the jobs. To do so we need to follow these steps * Go to settings -> Runners

* Click on add runner and follow the setups to connect your Linux VM with Github

We use these above commands in our vm like:

**Note: Make sure you mkdir the same as the repo name on your GitHub. For example, here we made “ObjcTest” which is the repo name** Check runner if connection “Idle” is available

### Step:2 Adding Repo secrets * To add secrets (API-KEY). Settings -> Secrets -> New Repository Secrets

* For our use case we will name the secret as API\_KEY

### **Step 3:** Adding our actions.yml * Now add our action.yml. In order to do that, make a folder structure like .github -> workflows -> action.yml, On the repo

* Make sure that at line 18 of action.yml we have the same APP\_NAME as that of the repo name * Commit and see the action run

* Once the action is done. Check our UI for the results

# Methods for CI/CD integration with CLI CI/CD integration with CLI Now you can start online scans with the new CLI command: ### Method 1: Scan repo using our cluster ### `cdefense online` ### Options: `cdefense online --api-key={} --repository-url={} --branch-name= {optional} --tag={optional} (You should have ENV variable SCAN_URL=https://console.clouddefenseai. com)` ### `Example:` `cdefense online --api-key=76858509-fe91-4969-b57a-decc36d0726a --repository-url=`[`https://github.com/mono/mono`](https://github.com/mono/mono) `--branch-name= example --tag=example (You should have ENV variable SCAN_URL=https://console.clouddefenseai. com)` Command will return exit status 1 if build policy was failed. ### `Scan private repo` `We also support private repositories. To do this you need to provide API key related to account where integration is configured or provide an access token into repository URL:` `GitHub:` `https://{private-access-token}@github.com/username/repo.git` #### `GitLab:` `https://oauth2:{personal-access-token}@gitlab.com/username/repo.git` `https://{username}:{password}@gitlab.com/username/repo.git` #### `Azure Repo:` `https://{private-access-token}@dev.azure.com/orgname/projectname/_git/repo` #### `Bitbucket:` `https://{username}:{access_token}@bitbucket.org/username/repo.git` ### `Example output` #### `Without verbose:` ``` // cdefense online --api-key=76858509-fe91-4969-b57a-decc36d0726a --repository-url=https://bitbucket.org/kilaruoleh/vulnado 2022/07/15 16:59:52 [INFO] Connecting to server... 2022/07/15 16:59:53 [INFO] Welcome [developer@clouddefense.ai]. You have been successfully connected to [Cloud Defense] organization 2022/07/15 16:59:53 [INFO] Running full online scan... 2022/07/15 17:01:19 [INFO] Scan was finished 2022/07/15 17:01:19 [INFO] Build policy status: FAILURE Failed build policy results: /app/pom.xml : java_maven: - Rule [CWE PART_OF_OWASP Injection] failed. Number of occurrences: 1 - Rule [TITLE CONTAINS inje] failed. Number of occurrences: 1 [INFO] Scan started at 16:59:52 finished at 17:01:19 [INFO] Total scan time: 1m27s ``` #### With verbose: ``` // cdefense online --api-key=76858509-fe91-4969-b57a-decc36d0726a --repository-url=https://bitbucket.org/kilaruoleh/vulnado --verbose 2022/07/15 17:00:16 [INFO] Connecting to server... 2022/07/15 17:00:16 [INFO] Welcome [developer@clouddefense.ai]. You have been successfully connected to [Cloud Defense] organization 2022/07/15 17:00:17 [INFO] Running full online scan... 2022/07/15 17:01:43 [INFO] Scan was finished 2022/07/15 17:01:43 [INFO] Build policy status: FAILURE { "/app/pom.xml : java_maven": { "failureBuildPolicyResults": [ { "message": "Rule [CWE PART_OF_OWASP Injection] failed. Number of occurrences: 1", "rule": { "operand": "CWE", "operator": "PART_OF_OWASP", "value": "Injection" }, "count": 1 }, { "message": "Rule [TITLE CONTAINS inje] failed. Number of occurrences: 1", "rule": { "operand": "TITLE", "operator": "CONTAINS", "value": "inje" }, "count": 1 } ], "passedBuildPolicyResults": [ { "message": "Success", "rule": { "operand": "CRITICAL_SEVERITY_COUNT", "operator": "GREATER_THAN", "value": "1" }, "count": 1 }, { "message": "Success", "rule": { "operand": "CWE", "operator": "PART_OF_OWASP", "value": "Broken Authentication" }, "count": 0 }, { "message": "Success", "rule": { "operand": "CWE_ID", "operator": "CONTAINS", "value": "264" }, "count": 0 } ] } } [INFO] Scan started at 17:00:16 finished at 17:01:43 [INFO] Total scan time: 1m27s ``` ### Method 2: Scan repo on your system, but download repo from external (any git) Example: {% code overflow="wrap" %} ``` cdefense clidocker --api-key={} --scan-url=https://console. clouddefenseai.com --project-name={} --git=true --repourl=https://github.com/scalesec/vulnado --branch={optional} --tag={optional} ``` {% endcode %} ### Method 3: Scan repo on your system, but copy project from your PC Example: {% code overflow="wrap" %} ``` cdefense clidocker --api-key={} --scan-url=https://console. clouddefenseai.com --project-name={} --path={path-to-folder-with-app} -- repo-url=https://github.com/scalesec/vulnado --branch={optional} --tag={optional} ``` {% endcode %} Command will push data to console.clouddefenseai.com # CI/CD Policies {% embed url="" %} During a CI/CD pipeline, there are multiple ways a developer can make a build pass or fail by using policies like the following ### OSS Policy Licenses

With this a developer need to add the license either in Approved or Denied list via drag and drop

Any license detected by our scan, if it’s in approved list the build will pass from the CI/CD if not then it will fail the build ### Build Policy List

With this feature a developer scan pass or fail a build based on the criteria like, 1. Secrets Detection 2. Owasp Top 10 Detection 3. Vulnerability Count 4. ID/CVE/CWE Match

Any number or criteria set can will make a build stop or pass during a CI/CD pipeline # Jenkins integration with cdefence {% embed url="" %} ### Setting up pipeline script Click on your JOB -> Configure and setup up the pipeline script like following

From above screenshot we conclude that, * We are cloning the project we want to scan * Getting our cdefense cli * Running it against that project ### Running build and results on UI Click save and apply and hit build now

Once it done with the build and cdefense cli is done scanning you can see the results on our UI

# IaC on GCR Scan {% embed url="" %} ### Prerequisites * Google account * Created project in Google Console * Private repositories with images in Google Container Registry ### Scan Public images Go to **‘Applications’ -> ‘Scan’ -> ‘Other’ -> ‘GCR’** and insert name of the image you want to scan:

After the scan new application with the name of the image will be created:

### Scan Private images #### Step 1: Create a Service account. Go to ‘Google console’ -> ‘IAM & Admin’ -> ‘Service accounts’ -> ‘Create service account’. Fill ‘Service account name’ and ‘Service account ID’:

In the next section select ‘Storage Object Viewer’ role:

Click on the created account and go to the ‘Keys’ tab. Create JSON key:

Credentials file will automatically download. #### Step 2: Add Google Container Registry integration in CloudDefense. Go to ‘Integrations’ -> ‘Container Coverage’ -> ‘Google Container Registry’. Choose downloaded credentials file:

Click ‘Configure’. #### Step 3: Scan your private images. After successful configuration you can scan your own images. Go to the **‘Integrations’ -> ‘Container Coverage’ -> ‘Google Container Registry’ or ‘Applications’ -> ‘Scan’ -> ‘Other’ -> ‘Google Container Registry’ -> ‘Your own images’.** Choose host and the image (images) you want to scan:

# IaC on Amazon ECR Scan {% embed url="" %} ### Prerequisites * Amazon Root user * Private repositories with images in Elastic Container Registry ### Scan Public Images Go to ‘**Applications’ -> ‘Scan’ -> ‘Other’ -> ‘Amazon ECR’** and insert the name of the image you want to scan:

After scanning the new application with the name of the image will be created:

## Scan Private Images ### Step 1: Create an IAM user. Login as a root user in Amazon Web Services. Go to **‘Identity and Access Management (IAM)’ -> ‘Users’ -> ‘Add Users’.** Fill **‘User name’ and select ‘Access key’** credential type:

Go to **‘Attach existing policies directly’** and select ‘**AmazonEC2ContainerRegistryReadOnly’** permission:

Click **‘Next: Tags’**, then **‘Next: Review’,** then **‘Create user’**. Copy **‘Access key ID’** and **‘Secret access key’.**

### Step 2: Add Amazon ECR integration in CloudDefense. Go to **‘Integrations’ -> ‘Container Coverage’ -> ‘Amazon ECR’.** Paste your Access key ID and Secret access key, choose default region and click **‘Configure’:**

### Step 3: Scan your private images. After successful configuration you can scan your own images. Go to the **‘Integrations’ -> ‘Container Coverage’ -> ‘Amazon ECR’ or ‘Applications’ -> ‘Scan’ -> ‘Other’ -> ‘Amazon ECR’ -> ‘Your own images’.** Choose region, default one always will be selected (you can choose other default region in integration configuration) and choose the image (images) you want to scan:

# IaC on Docker Hub Scan {% embed url="" %} ### Prerequisites To integrate Docker Hub, users must have the following requirements available. * Docker Hub account * Private images in Docker Hub ## To Scan Public Images Go to ‘Applications’ -> ‘Scan’ -> ‘Other’ -> ‘Docker Hub’ and insert name of the image you want to scan:

After the scan new application with the name of the image will be created:

## To Scan Private images ### Step 1: Create Access Token in Docker Hub. Go to **‘Account settings’ -> ‘Security’ -> ‘New Access Token’.** Fill ‘Token Description’ and choose Read-Only access permission:

Click on ‘**Generate**’ and copy your Docker Hub ID and Access Token:

### Step 2: Add Docker Hub integration in CloudDefense. Go to **‘Integrations’ -> ‘Container Coverage’ -> ‘Docker Hub’.** Paste your Docker Hub ID and Access token and click **‘Configure’:**

### Step 3: Scan your private images. After successful configuration you can scan your own images. Go to the **‘Integrations’ -> ‘Container Coverage’ -> ‘Docker Hub’ or ‘Applications’ -> ‘Scan’ -> ‘Other’ -> ‘Docker Hub’ -> ‘Your own images’** and choose the image (images) you want to scan:

# Integration with ServiceNow {% embed url="" %} In order to create a new integration with your organization’s ServiceNow account, please consider the following guidelines. ### Step 1: Select ServiceNow from Integration Tab Once you are done with team creation, open the **Integration Tab** and then click the **ServiceNow** option under Team Tools.

### Step 2: Create New Integration with ServiceNow You must select the **NEW INTEGRATION** button, which is indicated in the accompanying image, and enter the necessary data for your team account to link with the team in order to integrate your existing ServiceNow account to the ClouldDefense ServiceNow Team Tool.

### Step 3: Input necessary information from your existing ServiceNow account Please enter all the data required for your team (optional), project, and ServiceNow integration credentials. In order to effectively integrate ServiceNow into the Clouddefense product, kindly give all the necessary information. To help you understand, we have included sample input.

### Step 4: Integrate ServiceNow Account Once you are done inputting all the valid information, then click on **INTEGRATE** button.

Within a few seconds, the system will successfully merge your ServiceNow account. The indicated interface will appear. # Integration with Jira {% embed url="" %} In order to create new integration with your organization’s Jira account, please consider the following guidelines. ## Jira Cloud ### Step 1: Select Jira from Integration Tab Once you are done with team creation, open the **Integration Tab** and then click the **Jira** option under Team Tools.

### Step 2: Create New Integration with Jira To add your existing Jira account with the ClouldDefense Team Tools Jira, you need to Click the **NEW INTEGRATION** button as marked in the following picture and input the required information of your team Jira account to link with the team.

### Step 3: Input necessary information from your existing Jira account Please input all the necessary information related to your team (optional), project, and credentials for Jira integration. Please provide all the valid information to successfully integrate Jira into the Clouddefense tool. We have given sample input for your better understanding.

### Step 4: Integrate Jira Account Once you are done inputting all the valid information, then click on **INTEGRATE** button.

The system will successfully integrate your Jira account in a few seconds. The marked interface will be displayed.

## JIRA Server ### Prerequisites * Users must have an existing Atlassian account, which requires: JIRA Software Credentials ### Step 1: in the integration page, select Jira

### **Step 2: Check the "Jira Server" checkbox** Now you need to go through all of the previous steps mentioned above until you see the "Jira Server" checkbox:

### Step 3: copy the project key from here Please copy the project key. Here is an example for this:

### Step 4: Input the “Domain name/organization / Jira server domain” Domain name / Organization / Jira server domain is found in the url of the project. For example:

### Step 5: Type the Jira Email and Authorization key

#### Create Jira Authorization key and generate a Jira api token. *Note: The Jira API token will be used as the Jira Authorization key.* *G*o to and click the “Create API token“ button for generating a new the API token.

Copy the API token and paste it in the Jira authorization key field.

### **Step 6: Integrate Jira Server**

# SSO Okta App Integration {% embed url="" %} ### Prerequisites * Users are required to access to Cloud Defense Account ### Step 1: SignUp with OKTA account Before creating an APP in OKTA, first login to Cloud Defense. Inside the Integrations tab, go to SSO, click on OKTA and copy the redirect URL.

### Step 2: Create App Integration with OKTA Account Go to the applications page in OKTA, and click on Create App Integration.

**Select Open-id connect as sign in method, and web application as Application**

In General Settings, enter App name, select Grant type as Client credentials and Authorization code as Client acting on half of a user, enter the redirect url copied from Cloud defense application, and paste it in redirect URLs.

#### Select Controlled access value from Dropdown option.

#### Cope the client ID and secret of the APP

#### Paste Id and Secret in our application integration page inside OKTA

#### Sign in with your email ID with which you registered on OKTA

### TROUBLESHOOTING STEPS: #### 1- Unexpected error while authenticating with identity provider and API is giving 502 bad gateway. #### **JIRA LINK - ** Fix- Check the client id and client secret. Most probably the issue will be with credentials, if other IDPs are working. In case all IDPs are not working and showing the same issue, then we can probably look at ingress logs. #### 2- Invalid Username or Password This error comes when we add the first login flow in identity provider settings as Linking Broker Flow. This error comes when we try to login with a new identity provider and email already exists with some other identity provider. In this case the below API fails and in the events we receive **IDENTITY\_PROVIDER\_FIRST\_LOGIN\_ERROR** `https://staging.clouddefenseai.com/auth/realms/cdefense/login-actions/first-broker-login?client_id=cdconsole&tab_id=o` The first step to debug this issue is to check the linking broker flow settings inside the authentication tab. Make sure if *Create User If Unique* and *Automatically Set Existing User* both are set to Alternative. Also check if both are added in the same order mentioned above. #### 3- Issues related to application redirecting to incorrect URLs

Make sure the correct frontend url is added in the realm settings as shown in screenshot 1. This is the frontend Url of our realm. \ Also, in the clients section, select cdconsole and make sure Root URL, Valid Redirect URIs and Base URL are added correctly as mentioned in screenshot 2. #### 4- Sometimes on fresh setup, we get the below error in keycloak. ERROR: value too long for type character varying(255) In order to fix this error, please update the type of *value* column in *user\_attribute* table as text. This will solve this error.

# Set up CloudDefense Single Sign-On (SSO) {% embed url="" %} Do you use an SSO provider and want to allow your developers easy access to CloudDefense via that? In this case, you can set up a single sign-on through your provider. The information you need to establish trust between CloudDefense and the identity provider depends on which type of SSO you are using. ## Overview Just a few simple steps are needed to establish trust between your identity provider (IdP) and CloudDefense. * In your identity provider platform, enter details about the CloudDefense. * Provide CloudDefense with details from your IdP. * Confirm the login process is working correctly. Depending on the type of SSO connection different details are required for establishing the trust between your identity provider and CloudDefense. The following sections elucidate those details. ## Use SAML for SSO To establish trust with CloudDefense, add an ACS URL/Single Sign On URL. * The Assertion Consumer Service (ACS) is the endpoint on the CloudDefense network that listens for requests from your identity provider to enable communication between users on your network and CloudDefense. This URL is sometimes called a Reply URL. If some more information is needed such as Entity ID etc. it can be found in CloudDefense metadata. * The Entity ID is the URL that uniquely identifies CloudDefense as a SAML entity or service provider--note, default Entity ID must be checked manually as no default is set for this. Use these details to set up the connection with your Identity provider (IdP): | Details | Description | | ------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | ACS URL | \*can be found in SAML (SSO) tab | | Entity ID | \*can be found in CloudDefense metadata | | Metadata |

| ### SAML information to provide to CloudDefense Obtain metadata URL from your identity provider. Provide this information to CloudDefense to establish trust on the service-provider side. Information contained in metadata: | Details | Description | | ---------------------------------------------------------- | ------------------------------------------------------------------------ | | Sign-In URL | The URL for your identity provider sign-in page | | The URL for your identity provider sign-in page | The identity provider public key, encoded in Base64 format | | The identity provider public key, encoded in Base64 format | Optional - The URL for redirect whenever a user logs out of CloudDefense | | Protocol binding | HTTP-POST is recommended, HTTP-Redirect is also supported | ### Use OpenID Connect (OIDC) for SSO (using Okta) When using OIDC for the connection between your Identity provider and CloudDefense, add the Callback/Redirect URIs in your identity provider to establish trust with CloudDefense. | Details | Description | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------ | | Callback/Redirect URIs | \*can be found in Okta (SSO) tab | ### OIDC information to provide to CloudDefense Get the following information from your identity provider. Provide this information to CloudDefense to establish trust on the service-provider side. | Details | Description | | ------------- | ---------------------------------------------------------- | | Client ID | The public identifier unique for your authorization server | | Client Secret | Needed to get access token | | Domain | IdP domain | # SIEM {% embed url="" %} Security information and event management (SIEM) technology supports threat detection, compliance and security incident management through the collection and analysis (both near real time and historical) of security events, as well as a wide variety of other event and contextual data sources. The core capabilities are a broad scope of log event collection and management, the ability to analyze log events and other data across disparate sources, and operational capabilities (such as incident management, dashboards and reporting). Some of the most used SIEM solutions are - Splunk, IBM Qradar and Azure sentinel

# Azure Sentinel Microsoft Sentinel is a cloud-native security information and event manager (SIEM) platform that uses built-in AI to help analyse large volumes of data across an enterprise. 1. Get API key from - [https://console.clouddefenseai.com/profile-management ]() 2. Now in your Azure Sentinel, we will use the Microsoft Management Agent (MMA) feature. 3. Let’s configure HTTP Data Source for showing a list of vulnerabilities in any specific application 4. Use this API endpoint with Application ID in end, to get list of all vulnerabilities, , you also need to send 1 header with key “apikey” and you can obtain your api key from - [https://console.clouddefenseai.com/profile-management ]() 5. Now, you can configure your parser / schema within Azure Sentinel, to access different key / values from json. **For more detailed information visit this -** # IBM Qradar IBM® QRadar® is a network security management platform that provides situational awareness and compliance support. QRadar uses a combination of flow-based network knowledge, security event correlation, and asset-based vulnerability assessment. 1. Open Dashboard Designer. 2. In the navigation pane, go to **Connector & Sources > Connector Sources.** 3. In the Connector Sources tab, click Add Source. An Add Connector Source window is displayed. 4. From the Connector Type list, select QRadar connector. 5. In the Connector Source Name field, enter a name for QRadar source. 6. Source name can contain alphanumeric characters and underscores. 7. In the Endpoint URL field, enter URL details for QRadar web service in the following format: 8. Above API endpoint requires Application ID in end, to get list of all vulnerabilities, you also need to send 1 header with key “apikey” and you can obtain your api key from - For more detailed information, check Qradar’s official documentation - # Micro Focus ArcSight Logger Micro Focus ArcSight Logger is a comprehensive solution for security event log management for easier compliance and efficient log search. 1. For configuring CloudDefense’s HTTP API with ArcSight logger, we will use the FlexConnector feature from MicroFocus ArchSight logger. 2. Obtain a Vulnerability listing Rest API from CloudDefense [https://console.clouddefenseai.com/api-v2/integrations/application/584174528 ]() 3. Above API endpoint requires Application ID in end, to get list of all vulnerabilities, you also need to send 1 header with key “apikey” and you can obtain your api key from - [https://console.clouddefenseai.com/profile-management ]() 4. Now, you need to create a custom parser within your ArcSight, We recommend you at this stage follow all instructions, mentioned by MicroFocus arcsight logger You can follow this official documentation for more clarity, get in touch with Microfocus customer support in case of any other configuration issues # Sharing Integration {% embed url="" %} You can share your integaration of: * Github * Github Enterprise * Gitlab * Gitlab Enterprise * Bitbucket * Bitbucket Server * Azure Here, we will be using Sharing integration on Bitbucket. ### Prerequisites * [ ] Users must have an existing Bitbucket account integrated, which requires: Bitbucket Credentials Integration settings can be shared on the Organization level and Team level. * **Sharing with the Organizations:** If the SuperAdmin share integration with the organization, all organization members will get access to that integration and be able to see the all repos. * **Sharing with Team:** If integration is shared with the team, all team members of that specific (you can select team) will get the access to that integration and be able to see all repos. ### Sharing Integration with Organization #### **Step 1: Click the “**

**” settings icon on that Integration** Please select the option button on the bitbucket integration from the Integration page.

#### Step 2: Click share with Organization To share this integration with the whole organization, please select the “Share with Organization” option

#### Step 3: click share Please click share button to share this integration with the whole organization

### Sharing Integration with Team #### **Step 1: Click the “**

**” settings icon on that Integration** Please select the option button on the bitbucket integration from the Integration page.

#### Step 2: Click “Share with The Team” To share this integration with a specific team only, please select the “Share with The Team” option

#### **Step 3: click the dropdown button of “select team…”** Please click the dropdown button of “select team…” to share this integration with the specific team

#### Step 4: search the desired team Please search the name of the desired team on the search bar

#### Step **5**: click share. Please click the share button to share this integration with the selected team only.

# How to Enable Multi-Factor Authentication {% embed url="" %} ### Prerequisite * You need to be a SuperAdmin ### Step 1: Go to Org Settings Click on the settings icon, in the headers tab, next to the notifications icon. Click on org settings. Keep the toggle on for MFA and save the settings

### Step 2: It’s Activated for all the team members That’s it. Now all of your team members need to provide the OTP from their registered email address to get access to your organization.

# AUTO PR {% embed url="" %} ### Prerequisite * Must have an online scan either from UI or CLI. ### Step 1: Patch the vulnerable dependencies Once SCA scan is done, we can patch the vulnerable dependencies directly from UI if Source Control (Github/ Gitlab/ Bitbucket) is configured and you know that repo. Open the SCA results and click on any dependency that is present in the manager file. For this example, we will take pom.xml

And now click on Fox this vulnerability, if success full we get,

### Step 2: GitHub Check On Github, we check if a pull request is generated or not.

PR is requested, which can be merged. # Remediation using SAST Recommendations {% embed url="" %} Recommendation service helps you understand the impact or root cause of any detected vulnerabilities, recommendation service also correlates detected findings or vulnerabilities with OWASP top 10 rankings to give you more context and information on detected vulnerabilities. Recommendation service gives you two kinds of recommendations for any detected vulnerabilities.
1. **Descriptive** - This kind of recommendation helps you understand vulnerabilities and some methods to protect your application from such vulnerabilities by following some basic rules or good practices. This kind of recommendation is not focused on any specific tech stack or programming language. The descriptive recommendation shows you the following details * OWASP Ranking * CWE Information * Some example bad codes * Attack Scenarios * Attack prevention techniques 2\. **Code Snippets** - This kind of recommendation gives you examples of code snippets in different programming languages, where our recommendation services show you vulnerable codes and fixes for those vulnerabilities. ### Step 1 : Select “Recommendations” for recommendations. To understand how a recommendation service works. You can run a SAST scan for any supported programming language and then open the report. You’ll see a “Recommendations” button in the footer section of each finding. Click on **“Recommendations”** and you’ll see this kind of popup with detailed recommendations.\

Here you can see a detailed description of CWE-22 and if you scroll down, you’ll also see more detailed attack prevention techniques.

### Step 2: Code Recommendations The next part is code recommendations. As you can see, there are some code recommendations here. You’ll also notice an arrow icon on top of code recommendations, that gives you an option to see code suggestions in different available languages like javascript, java, python, php, ruby, etc.

# Global Allowed List and Local allowed list - Documentation {% embed url="" %} ## Global Allowed List Global Allowed List helps you suppress those SAST rules that you don’t need. Using this Global Allowed list, you can remove false positives from all future scans related to that specific tech stack. Global allowed list can be turned on and off using SAST Rules, to use this feature follow below steps. ### Step 1: Login to your CloudDefense Instance and click on “Compliance”

### Step 2: Click on SAST Rules option

Here you can see a toggle button for each SAST rule related to “Java” (you can switch language from the dropdown above).

Use these toggle buttons to remove any findings from any project related to this specific programming language. You can also change the default severity for this rule with your own custom severity, and CloudDefense will use that severity instead of the default one. ## Local Allowed List Local Allowed List works like Global allowed list, there is only one small difference between global and local allowed list and that is from where these rules are applied or how this works. When you use a local allowed list, you make these changes only at the application level, so all changes will be reflected for that specific application, whereas a global allowed list affects all of your applications. To use local allowed list follow below option 1. Login to your CloudDefense Instance 2. Choose any scanned application

3\. Now expand this list and click on “Code Analysis”

4\. Now you can see reported findings like this, and you can also see a button “Add to allowed list”

5\. Click on “Add to allowed list”, and that specific issue will be removed from your scan results. 6\. Now, what if you want to see those suppressed findings again? Simply toggle that “Allowed vulnerabilities” button on top.

# File Exclude {% embed url="" %} ### Prerequisite * Must have an online scan either from UI or CLI. ### Step 1 : Scan UI Once scans are finished, we can go to the UI. There is a feature to exclude file paths from the project tree if developers don’t want to scan those via Exclude File Path. To do that, start a scan in UI.

Once the scan finishes.The interface will be as follows

### Step 2 : Exclude Path We now exclude a path which is similar to the following picture.

### Step 3: Re-run Scan Now re-ran the scan to see if /apps/ path is excluded from next scan

Now we cannot get any thing from the path (/apps/) which we excluded. # Cloud Defense CLI CloudDefense's CLI helps you find and fix known vulnerabilities in your dependencies, both on local projects and as part of your CI/CD system. {% embed url="" %} ### Installation Please follow instructions specific to your operating system. ### How to update CLI? By just rerunning the command updates the client to latest version. #### Mac Run the following command which will install `cdefense` tool. Prefix with `sudo` if you see any permission error when running this command `curl\https://raw.githubusercontent.com/CloudDefenseAI/cd/master/latest/cd-latest-mac-x64.tar.gz > /tmp/cd-latest-mac-x64.tar.gz && tar -C /usr/local/bin -xzf /tmp/cd-latest-mac-x64.tar.gz && chmod +x /usr/local/bin/cdefense` **Linux** Run the following command which will install `cdefense` tool. `sudo curl\https://raw.githubusercontent.com/CloudDefenseAI/cd/master/latest/cd-latest-linux-x64.tar.gz > /tmp/cd-latest-linux-x64.tar.gz && tar -C /usr/local/bin -xzf /tmp/cd-latest-linux-x64.tar.gz && chmod +x /usr/local/bin/cdefense` **Windows** Download the following tar file and unzip it `https://github.com/CloudDefenseAI/cd/raw/master/latest/cd-latest-windows.exe.tar.gz` ### Usage Run the following command to get started. **cdefense help** NAME: Cloud Defense CLI Scanner - CLI for scanning and detecting vulnerabilities in any language USAGE: cdefense \[global options] command \[command options] \[arguments...] VERSION: 1.0.1 COMMANDS: scan, s SCA scan of a given project and post to Cloud Defense server sast, a SAST scan of a given project and post to Cloud Defense server help, h Shows a list of commands or help for one command GLOBAL OPTIONS: \--help, -h show help (default: false) --version, -v print the version (default: false) ### Examples #### SCA #### Example of python SCA scan `cdefense scan --lang=python --api-key= --path=/d/temp/vulpy/requirements.txt --project-name="my-python-project" ` #### Example of java SCA scan `cdefense scan --lang=java --api-key= --path=/d/temp/java-goof --verbose --project-name="My Java Project" ` #### Example of php SCA scan `cdefense scan --lang=php --api-key= --path=/d/temp/php-helloworld-app --project-name="my-php-project" ` #### Example of NodeJS SCA scan `cdefense scan --lang=node --api-key= --path=/d/temp/nodejs-system --project-name="my-nodejs-project"` ### SAST #### Example of python SAST scan `cdefense sast --lang=python --api-key= --path=/d/temp/vulpy/requirements.txt --project-name="my-python-project" ` #### Example of java SAST scan `cdefense sast --lang=java --api-key= --path=/d/temp/java-goof --verbose --project-name="my-java-project" ` #### Example of php SAST scan `cdefense sast --lang=php --api-key= --path=/d/temp/php-helloworld-app --project-name="my-php-project" ` #### Example of NodeJS SAST scan `cdefense sast --lang=node --api-key= --path=/d/` ### FULL SCAN #### Example of full scan `cdefense online —api-key= —repository-url=` # Install CloudDefense Helm on a Kubernetes Cluster {% embed url="" %} ### Prerequisite A kubernetes cluster whose nodes have to linux/amd64 architecture ### Development Environment * Helm (v3 or above) * Kubernetes Cluster (kubectl) * Minimum Requirement - 1 Node (2 vCPU 8 GB RAM) * Recommended Requirements - 2 Nodes (2 vCPUs 16 GB RAM) ### Production Environment * Helm (v3 or above) * Managed Postgres Instance for ex. AWS RDS (db.r5.large) * Kubernetes Cluster (kubectl) On Demand Nodes in Node Groups with Labels Node Groups Node Type Node Groups Node Type | Node Groups | Node Type | Level | Min Nodes | Max Nodes | | ----------- | ---------------------- | --------- | --------- | --------- | | external | t3.medium (2vCPU 4GB) | on-demand | 1 | 4 | | auth | t3.medium (2vCPUs 4GB) | on-demand | 1 | 4 | | api | c5.large (2vCPUs 4GB) | on-demand | 1 | 4 | | web | t3.medium (2vCPUs 2GB) | on-demand | 1 | 4 | | job | C6i.large (2vCPUs 4GB) | spot | 1 | 4 | ### Install Cluster Auto-Scaler ### Install Kafka Download the kafka helm repo (bitnami) ```` ``` helm repo add bitnami https://charts.bitnami.com/bitnami ` ```` Install kafka helm ```` values.yaml ``` nodeSelector: label: external ``` ``` helm install kafka bitnami/kafka -f values.yaml -–debug ``` ```` ### Install CloudDefense Helm 1. clone create roles, role binding and service accounts ```` ``` kubectl apply -f cdefense/rbac ``` ```` 2\. create secrets ```` ``` kubectl apply -f cdefense/secrets ``` ```` 3\. add helm repo ```` ``` helm repo add cdefense https://clouddefenseai.github.io/charts/ ``` ```` 4\. Install cdefense ```` ``` helm install cdefense cdefense/cdefense --debug ``` ```` 4\. update/upgrade ```` ``` helm upgrade cdefense cdefense/cdefense ``` ```` ## Configure CloudDefense Helm for SSO In order to sign in with different identity providers (for ex. github), create ID and secrets ### Step 1: Create id, secrets for github 1. go to [github developer settings](https://github.com/settings/developers) 2. Create a New OAuth App 3. Homepage URL is the base\_url 4. Authorization callback URL is https\://{base\_url}/auth/realms/cdefense/broker/github/endpoint

### Create id, secrets for gitlab

### Create id, secrets for bitbucket

### Create id, secrets of Microsoft Create secrets on kubernetes cluster 1. Create a secret for authservice or use a yaml file ``` apiVersion: v1 kind: Secret metadata: name: authservice-secrets type: Opaque stringData: SENDGRID_KEY: GOOGLE_CLIENT_ID: GOOGLE_CLIENT_SECRET: GITHUB_CLIENT_ID: GITHUB_CLIENT_SECRET: GITLAB_APPLICATION_ID: GITLAB_APPLICATION_SECRET: BITBUCKET_KEY: BITBUCKET_SECRET: MICROSOFT_CLIENT_ID: MICROSOFT_CLIENT_SECRET: ``` 2\. Restart authservice pod ``` kubectl apply -f authservice-secrets.yaml ``` ### Configure CloudDefense Helm for Importing Repositories Debugging and Troubleshooting Pod Description Steps # Install CloudDefense suite on a Kubernetes cluster {% embed url="" %} ### Pre-requisites There are three main pre-requisites for a production grade cdefense installation on-premises 1. A managed Postgres instance (for AWS RDS db.r5.large) 1. enable automated backups 2. A kubernetes cluster (/examples/eks) with at least two nodegroups 1. node group for jobs 1. each node has { label: job } 2. node group for all else 1. (optional) each node has { label: cdefense } 3. A cluster auto-scaler ### Install kafka * Download the kafka helm repo (bitnami) ``` helm repo add bitnami https://charts.bitnami.com/bitnami ``` * (optional) create/edit `values.yaml` ``` nodeSelector: label: external ``` * Install kafka helm ``` helm install kafka bitnami/kafka -f values.yaml ``` ### Install cdefense * add cdefense helm repo ``` helm repo add cdefense https://clouddefenseai.github.io/charts/ ``` * update repos ``` helm repo update ``` * clone the repo ``` git clone https://github.com/CloudDefenseAI/charts ``` * create roles, role binding and service accounts ``` kubectl apply -f charts/cdefense/rbac ``` * create secrets ``` kubectl apply -f charts/cdefense/secrets ``` * Install cdefense helm ``` helm install cdefense cdefense --debug ``` or ``` helm upgrade cdefense cdefense/cdefense --debug ``` ### Configure Social Authentication In order to sign in with different identity providers (for ex. github), create ID and secrets #### Github * go to [github developer settings](https://github.com/settings/developers) * create a New OAuth App * Homepage URL is the base\_url * Authorization callback URL is [https://{base\_url}/auth/realms/cdefense/broker/github/endpoint](https://%7Bbase_url%7D/auth/realms/cdefense/broker/github/endpoint)

#### create secrets for authservice * create a secret for authservice ``` apiVersion: v1 kind: Secret metadata: name: authservice-secrets type: Opaque stringData: SENDGRID_KEY: GOOGLE_CLIENT_ID: GOOGLE_CLIENT_SECRET: GITHUB_CLIENT_ID: GITHUB_CLIENT_SECRET: GITLAB_APPLICATION_ID: GITLAB_APPLICATION_SECRET: BITBUCKET_KEY: BITBUCKET_SECRET: MICROSOFT_CLIENT_ID: MICROSOFT_CLIENT_SECRET: ``` ``` kubectl apply -f authservice-secrets.yaml ``` * restart authservice pod ### How to change location of logs * update value.yaml ``` api: logs: region: bucket: ``` #### in case of private bucket * Edit the scan-server-secrets.yaml file ``` AWS_SCAN_S3_ACCESS_KEY: AWS_SCAN_S3_SECRET_KEY: ``` ``` kubectl apply -f scan-server-secrets.yaml ``` * or update secrets on cluster * encode values as base64 strings ``` AWS_SCAN_S3_ACCESS_KEY= BASE64_AWS_SCAN_S3_ACCESS_KEY=$(echo $AWS_SCAN_S3_ACCESS_KEY | base64) ``` ``` AWS_SCAN_S3_SECRET_KEY= BASE64_AWS_SCAN_S3_ACCESS_KEY=$(echo $AWS_SCAN_S3_SECRET_KEY | base64) ``` * edit scan-server-secrets ``` kubectl edit secret scan-server-secrets ``` ``` AWS_SCAN_S3_ACCESS_KEY: AWS_SCAN_S3_SECRET_KEY: ``` * save and restart api pod ``` kubectl delete pod api- ```
# Team Management {% embed url="" %} CloudDefense allows you to create team under team management tab. The admin can invite both new and existing users as team member and can give access to selected features. For example, let's create the first team. Clicking on the “Teams” tab will navigate you to the team management screen (Tab is available only for admins). To create a new team the only thing is required - a team name. The description is optional.

After filling the data - click on the create button. Now your team is created. (Frontend is a demo team created for your convenience.)

What do the counts at the top menu? Let's figure it out (For your convenience we numbered from 1 to 4). These counts are a small summary of your organization's team management, represented in number format. About all of them in details: Note\* All of the counts are calculated depending on your role and your access to the teams/applications. F.e *Super Admin* (who is allowed to manage all the teams/applications) will see the counts overall whole organization while TeamAdmin (who is allowed to manage the teams he participates in) will see only counts accessible to him. 1. **Teams**: Displays the number of teams created in your organization or accessible to you. 2. **Admins:** Displays the number of admins in the teams which are accessible to you. 3. **Employees:** Displays the number of employees in your organization (For SuperAdmin) or in the teams, you manage (For TeamAdmin) 4. **Applications:** Displays all the applications which can be added to the team. Clicking on the team you will be navigated to the team details page, where you can: 1. **Delete team** - Delete team button; 2. **See the Team Stats** (how many users, teams, admins are in the specific team) - Team counts 3. **Manage the team name and description** - Team Configuration; 4. **Add users** to the team (new and existing) - Team Users; 5. **Add applications to the team** so AppUsers can see them in the list - Team Applications; We will figure out how all the steps mentioned above work a little bit later, but now let's check how the screen of the team details looks like after first time landing on it:

### Actions Items on Team Management: #### Delete team To delete a team, you have to click on the trash icon in the top bar. If you can delete team, you will see the confirmation modal, after confirming action team will be successfully deleted. What means that you can delete the team? It means that you should have access to it and the team should be ‘empty’ (No applications or users wired with the team). If team is not ‘empty’ - you will see next modal with the action required:

#### Team Stats For all users on this page, counts are displayed the same, and they show data of the specific team which you have chosen. #### Manage the team name and description If you want to change the name or description of the team, simply change it in the inputs and hit on the update button. #### Add users to the team You can add existing users or new users to the team. To add user, click the ‘adding users button’ in the team users section. You will be redirected to the next screen:

If you want to add user which is already in your organization, he can be the part of other teams, you can search his account by entering email or part of the email in the input. If user(s) were found, you can select the one you want to add and click on the ‘*plus*’ icon. If you want to add new user to your organization, click on the ‘*New User*’ tab.

***User roles description:*** * **Super Admin**: Super Admin has access to all the functions available under a particular team. They can change the role of existing team members if required. * **Team Admin**: Team admins have the access to control the activity of team members only. * **App User**: The app user role allows the assigned member to test the basic scans using the application that you have inserted. Other team administrative functions are not available in the app user interface. Fill in the form with the email address and select its role. After inviting, user will be notified by email and automatically added to your organization and the team you wanted to add to with the pending status.

\*Note One user can be added to multiple teams. But currently, the user role in all of the teams will be the same. F.e if you invite user ‘****’ to the **A team** and assign **TeamAdmin role**, adding this user to the **B team**, meaning that the user will be **TeamAdmin in both teams**. Demoting in the A team will affect the B team as well. There are 3 different actions that you can perform on users in the team management. Menu with the actions is available after hitting the ‘menu’ icon (3 dots) on the right side of every user entry; * **Deactivate user** - You can deactivate a user from your organization. Users will not be able to login to your org anymore if you deactivate them. You will see such users with the ‘deactivated’ status; * **Remove user from the team** - You can remove users from the selected team but keeps in the organization; * **Resend user invite** - This resends the invite to the user, if he has not accepted it in time. #### Add applications to the team: You can add applications to the team, and make them visible to team participants. To add an application to the team click on the ‘adding application button’ in application section.

You will be redirected to the page with the all available applications tabled.

\*Note: One application can be added only to one team currently. In the list above only applications which can be added will be displayed. F.e I have 2 teams A and B (they are empty) and 2 applications ‘App1’ and ‘App2’. I want to add App1 to team A. In the table I will see both applications. After adding App1 to team A i want to add App2 to team B. In the table I will see only 1 application which is App2 since App1 is already in another team. # User Management {% embed url="" %} User management tab allows the super admins to view the status of all the invited team members for each team in a single dashboard. Under this tab,only super admins can add new users,change the existing member’s role, remove or deactivate the existing members if necessary. About every action detailed below.

Landing on the ‘User Management’ page SuperAdmin can manage all the users. First we can see the slider at the top which switches all users list and deactivated users list. Then we have an opportunity to change the user role. There are 2 states, when you are allowed to change the role and not. If you are not allowed to change the user's role the role is grayed out. ### **User roles description:** * **Super Admin**: Super Admin has access to all the functions available under a particular team. They can change the role of existing team members if required. * **Team Admin**: Team admins have the access to control the activity of team members only. * **App User**: The app user role allows the assigned member to test the basic scans using the application that you have inserted. Other team administrative functions are not available in the app user interface. #### Possible reasons why you cannot change user role: * User is the owner of the organization (**Owner** - the person who created the organization, only the owner can manage SuperAdmins, and nobody can change data about the owner. If you want to change the organization owner, contact support). * User has the same role as you (You can only change users roles who is less privileges than you). * User has not accepted the invite yet (status pending). * User is deactivated. There are 3 different actions that you can perform on users in the team management. Menu with the actions is available after hitting the ‘menu’ icon (3 dots) on the right side of every user entry; * **Deactivate user** - You can deactivate a user from your organization. Users will not be able to login to your org anymore if you deactivate them. You will see such users with the ‘deactivated’ status; * **Remove user from the team** - You can remove users from the selected team but keeps in the organization; * **Resend user invite** - This resends the invite to the user, if he has not accepted it in time. ### Invite Users to the Organization Click on the ‘plus’ icon in the section and you will be redirected to the adding user screen.

To add users you have to fill 3 fields: Insert user email, choose the user role, choose the team. All steps are required. If you don't have a team, before adding a user you should create it. [Click here](#user-roles-description) to know more about User Roles After inviting, the user will be notified by email and automatically added to your organization and the team you wanted to add to with the pending status. # App Management {% embed url="" %} Application management allows the SuperAdmin to manage the existing inserted repositories from the applications such as of Github, Gitlab, Azure, Bitbucket, DAST, API etc from all users in organization. In the application management section, you can find all applications in your organization and team to which this application relates to. You can quickly move the application through the teams by selecting the team in the dropdown.

One application can be assigned to only one team. You can always change the team of an application. # LogIn/Signup process {% embed url="" %} To login or Signup with CloudDefense,please refer following steps as mentioned. ### Step 1: Enter into Console Interface CloudDefense login/signup option begins from the console interface which you can find by [clicking here](https://console.clouddefenseai.com/). The interface will look like the following picture.

### **Step 2: Sign Up to CloudDefense Console** If you are using CloudDefense Console first time, please make sure to sign-up with any one of the available account you from**:** * [GitHub](https://github.com/) * [Gitlab](https://gitlab.com/), * [Google](https://www.google.com/), * [Bitbucket](https://bitbucket.org/), * [Microsoft](https://www.microsoft.com/) * [Email ](https://mail.google.com/) Once you are done with the sign up procedure you will find the following interface.

You won't need to sign up again if you've already registered with the CloudDefense Console interface. Simply log in using the account you previously created. You may also log in using your corporate email if your organization already has an SSO (single sign-on) account with CloudDefense.