The Overview with Fast Scan panel is part of the onboarding workflow introduced in 2.3.1. It will only be populated when this onboarding workflow is enabled and used - see Administration Center - Settings - Application Onboarding. See also Workflow - Application onboarding with Fast Scan.

Introduction

The panel contains the results of the fast scan phase/deep analysis for a newly onboarded application when using the onboarding with Fast Scan workflow (see Administration Center - Settings - Application Onboarding for information about how to enable it). The process of delivering application source code is exactly as in the legacy onboarding workflow (either via a ZIP archive file or via a designated source code folder on disk) however, the onboarding with Fast Scan process is not a "quick" one-shot onboarding (upload source code, analysis, snapshot, publishing in one go): instead, source code is delivered and then Console will perform the initial "fast-scan" phase to determine the application's technologies/languages/frameworks etc.

When the fast scan phase is complete, users are directed automatically to this Overview with Fast Scan panel where the delivered source code can be inspected (size, structure etc.) for completeness, source code filters (exclusions) can be defined and any "additional options" such as automatic extension installation, activation of Security Dataflow analysis etc. can be activated. Following that, an analysis and publishing to CAST Imaging or Dashboards (i.e. generating a snapshot) can be launched. When an analysis and upload to CAST Imaging/Dashboards has been completed, this Overview panel remains available and additional information will be presented about the deep analysis results.

The main goal of this panel is to encourage source code to be inspected before it is sent for deep analysis to ensure that the correct source code has been delivered and any unwanted code can be excluded.

Access

To access the panel manually, move to the Console screen if you are not already there:

Find the application that has been onboarded using the Onboarding with Fast Scan workflow and click it:

Overview panel

Click to enlarge

Header

The Header section provides basic information about the source code that has been delivered:

Click to expand

Last action date & time	Date and time the application was onboarded. When new source code is uploaded, this value will update.
Status	Indicates the current state of the application: Fast scan done > The fast scan process is complete - i.e. the uploaded source code has been scanned to determine the contents: technologies/languages/frameworks. Fully analyzed > The source code has been analyzed and that upload to CAST Imaging / CAST Dashboards has occurred. Note that if any missing dependencies are detected in your source code during the analysis (i.e. code that is calling another piece of code that cannot be found) a warning icon will be displayed. This should be fully investigated and corrected because it means that results may not be coherent. Clicking the warning triangle will direct you straight to the log file to see the missing dependencies alerts. See also Validate dependency configuration.
Application Map	Only visible when the status is Fully Analyzed. Links directly to the application in CAST Imaging.
Total files	Total number of files that have been designated as source code (i.e. programming language types) by Console during the fast scan process or during a Refresh/Upload New (see below). In other words, files that are not considered source code (i.e. image files for example) are not included in this file count.
Application size	Total number of Line of Code (LoC) in the designated source code, as identified by Console during the fast scan process or during a Refresh (see below) - files that are not considered source code (i.e. image files for example) are not included in this value. In addition, an indicator shows the "size" of the application - clicking View Size Chart will show how Console defines the various different size categories:
New scan	Enables you to upload a new source code ZIP file or deliver new source code from a folder (see Administration Center - Settings - Source Folder Location). You can do this even if you have not yet run an analysis, i.e. when the previous fast scan has highlighted some deficiencies in the delivered code that you want to correct. if you have already uploaded a source code ZIP, the button will display the following dialog box enabling you to choose a new ZIP file. A new fast scan will then be automatically actioned on the new source code: if you have already delivered source code from a source folder location, the button will display the following dialog box showing the location of the previous source folder. Ensure the source folder contains the new updated source code before clicking the Fast Scan button: Technical information Technically, the following things occur when a New Scan is triggered: any excluded files are deleted the current version is deleted and a new one is created with the same name, same title, same release date the new source code is scanned and data in the Overview panel is refreshed using the scan results no associated snapshots are deleted

Zip Content/Folder Content

This section will be collapsed when a deep analysis has been actioned.

The Zip Content/Folder Content section provides details of the source code that has been uploaded (either via a ZIP file or via the source folder location) with the means to filter (i.e. exclude) certain files and folders:

Click to enlarge

File Filter	This button will reveal the File Filter settings allowing you to: exclude specific files and/or folders using regular expression based exclusions enable/or disable various rules to exclude or include specific projects or components Expressions A set of exclusion expressions will be predefined via the "default" Exclusion Template which contains the most common items that should be excluded (see Administration Center - Settings - Exclusion templates for more information). If you make any changes, use the Update button to apply them: You can add new custom filters as required: the pattern matching system uses glob patterns (see https://docs.oracle.com/javase/tutorial/essential/io/fileOps.html#glob for examples of how this system works). Enter an expression to match the folders/files you want to exclude and then click Add to add the expression to the list of excluded items: For example: .txt will exclude all files with the extension .txt* tests/ will exclude any folders named tests and everything inside them - e.g. root_folder/tests, root_folder/another_folder/tests .Tests/ will exclude any folders whose name includes .Tests* (for example C:\Support\Delivery\Sample.Tests\sample\) patterns starting with / will exclude starting only from the root folder. In other words, /tests/ will exclude everything in the specific folder root_folder/tests but not root_folder/another_folder/tests Take the following hypothetical example where an application has been delivered that contains the same .SQL file in four locations - this is not correct and three of them need excluding: To exclude the .SQL files located under the parent folder "JSP", you could manually exclude them by unticking them in the UI, however (if you have multiple files to exclude) you can also define an expression to automatically do this for you e.g.: [J]/*/.sql Where: *[J]/ matches any folder in the root path starting with an uppercase "J" (in our case "JSP") - if you have multiple folders in the root path, you can use the pipe character, for example [J\|e]/* will match all folders starting with an uppercase "J" and all folders starting with a lower case "e". / traverses all nested sub folders of the matched folder beginning with "J" /.sql* matches any files named "<something>.sql" Applying this expression automatically excludes the .SQL files located under the folder "JSP": CAST highly recommends using the Update Data option if you configure exclusions - see below. Excluding a folder or files via the UI will automatically add the specific items to the File Filter list. For example, the folder "pageart" has been manually excluded using the UI and this is reflected in the File Filter dialog: If you have already actioned an analysis and you subsequently exclude files/folders, then a banner will be displayed in the Application - Config screen to prompt you that the the configuration has changed and that you should run a new analysis in order to see the changes: Rules This section enables you to configure the "exclusion" rules for specific projects identified during the source code delivery. When an exclusion rule is matched, then the project in question will be ignored. The aim of these rules is to avoid a situation where multiple projects (and therefore Analysis Units) are generated for a given piece of source code when more than one is not needed. If you are unsure, you should leave the default settings as they are and review them as a post analysis action item: for an Application's first version, all options are selected except Exclude Maven Java projects when an Eclipse project also exists and Exclude Java Files project located inside other Java Files Project. for an Application's subsequent analyses, exclusion rules are pre-selected according to the options chosen in the previous analysis. the option Exclude all empty projects refers to projects that do not have associated source code. the option Exclude Test code will exclude all folders named "test" that are discovered during the source code delivery
Update data	The option should be run if you have added source code exclusions. It will run a scan on the existing uploaded source code to update the data in the following sections: Header Software Composition Architecture Preview Identified Frameworks It is not mandatory to run the option, however, doing so can help you understand the impact of the source code exclusions you have added.
Left panel	The delivered source code is depicted in tree format. This is interactive and selecting an item in the tree will update the middle and right hand panels. In addition, a filter can be set to exclude an item from the subsequent analysis process by clicking the icon shown in the image below. When the icon is shown in red, the entire selected folder and all files, sub folders and files will be excluded from the analysis: CAST highly recommends using the Update Data option if you configure exclusions - see above. Excluding a folder or files via the UI will automatically add the specific items to the File Filter list. For example, the folder "pageart" has been manually excluded using the UI and this is reflected in the File Filter dialog: If you have already actioned an analysis and you subsequently exclude files/folders, then a banner will be displayed in the Application - Config screen to prompt you that the the configuration has changed and that you should run a new analysis in order to see the changes:
Middle panel	This panel depicts the content of an item selected in the left panel and divides them into categories as follows showing the total number of files: Files selected for deep analysis Files not selected for deep analysis And then: Programming Documentation Data Build Each item depicts, per technology type, the total number of files that will be sent for deep analysis and those that will not be sent for deep analysis - i.e. have been excluded through one of the exclusion methods: Items in the categories themselves are interactive and when clicked, will update the content in the right hand panel.
Right panel	The right panel displays the content of selections made in the left and middle panels and provides: a search mechanism a way to exclude individual files a way to view source code Search mechanism The search mechanism is a simple filter on the file name itself. For example, entering "auth" shows the following files: Exclusion mechanism Files that have already been excluded via a specific filter, or because the parent folder has been excluded using the icons in the left panel, will be displayed with a strikethrough and a disabled unticked check box as shown below: Click to enlarge To exclude individual files, untick the files - the file text will use strikethrough: Files that are excluded will contain roll over tooltip information (in ≥ 2.9) to explain which pattern has excluded the file. For example, the following file was excluded in the right hand panel using the tick box and the pattern listed in the roll over tooltip will be added as a filter: This file was excluded by a filter called "bookdemo/": CAST highly recommends using the Update Data option if you configure exclusions - see above. Excluding a folder or files via the UI will automatically add the specific items to the File Filter list. For example, the folder "pageart" has been manually excluded using the UI and this is reflected in the File Filter dialog: If you have already actioned an analysis and you subsequently exclude files/folders, then a banner will be displayed in the Application - Config screen to prompt you that the the configuration has changed and that you should run a new analysis in order to see the changes: Code viewer Selecting a file in the list will display its source code:

Software Composition

This section will be collapsed when a deep analysis has been actioned.

The Software Composition section provides details of the uploaded source code - note though that like the Header section, this only shows details of source code that has been designated as source code (i.e. programming language types) by Console during the fast scan process or during a Refresh/Upload new. In other words, files that are not considered source code (i.e. image files for example) are not included in this data:

Click to enlarge

On the left an interactive chart depicts the content of the uploaded source code that has been designated as source code (i.e. programming language types), using three different measures:

Lines of code: total lines of code per technology
File Count: total number of files per technology
File Size: total file size per technology, in bytes

Rolling the mouse pointer over the items will display more information:

On the right, the same information is displayed in table format. In addition, a column shows how the identified technology will be analyzed, using:

Product Extension > an extension provided and supported by CAST
Community Extension > an extension built by the CAST wider community (not supported by CAST)
No Known Extension > this technology will not be analyzed since there is no extension available to support it.

Architecture Preview

The Architecture Preview section is a graphical representation of the delivered source code before an analysis is run - this is determined during the fast scan process. The section's primary aim is to help check the completeness of the source code that has been delivered. Use the icon indicated with the red arrow to enlarge the preview:

All links between blocks are based on supposition only. Final architecture from an analysis may be different.

When a deep analysis has been completed, the display will automatically update to show a graphical representation of the source code as detected by the analysis process:

Items marked in green confirm expected elements (technologies, frameworks, and links).
Items marked in blue denote an additional element that has been identified during the analysis.
Items in dashed white show an expected element that has not been found during the analysis.
Numbers correspond to the number of occurrences of the item that have been found.
DL refers to "Dynamic Link" (i.e. links that have been found using search string technology) - see Validate Dynamic Links

Identified Frameworks

The Identified Frameworks section lists all the frameworks that have been detected by Console during the fast scan phase:

The icon depicts how the identified framework will be analyzed, using the same legend as in the Software Composition section:

Product Extension > an extension provided and supported by CAST
Community Extension > an extension built by the CAST wider community (not supported by CAST)
No Known Extension > this framework will not be taken into account since there is no extension available to support it

Analysis Reports

This section is only displayed when a deep analysis has been actioned.

This section provides a report on the files discovered/analyzed/excluded/not analyzed for the current version:

File Extensions	A list of file extensions found in the delivered source code. Extensions are grouped by technology/language - and the extension that is displayed by default (the primary extension) is the extension with the largest number of files in the delivered source code. Other related file extensions that are found will also be displayed alongside: For the Mainframe - JCL technology, the extension .prc is not considered part of JCL language (in the vast majority of cases, these files do not contain any JCL related code), so files with this extension will be ignored in the analysis report.
Technology/Language	Technology or language of the file as detected by Console.
CAST Extensions	The CAST Extension Console has used to process the file. Note that some primary file extensions may be listed as processed with multiple extensions. For example the .js file extension will appear twice: once with com.castsoftware.html5 once with com.castsoftware.jee.
Total	The total number of files of this type found in the source code delivery, either delivered in a ZIP file or in a source code folder. The table is sorted by default on this column.
Excluded	The total number of files of this type that were manually excluded during the source code delivery process. This number is the difference between Total and To Analyze.
To Analyze	The total number of files of this type that were submitted for analysis.
Fully Analyzed	The total number of files of this type that were analyzed during the most recent analysis process. This number is taken directly from the analysis schema in which the analysis results are stored, in other words this number reflects the number of files that were saved as part of the analysis process. Note that in Console ≥ 2.4, files classed as external (third party libraries etc.) can be included in this figure as well as internal files (previous releases never included external files).
Not Analyzed	The total number of files of this type that were not analyzed during the most recent analysis process. This number is the difference between the Fully Analyzed and To Analyze (i.e files that are submitted for analysis, but not saved in the analysis schema). Note that in Console ≥ 2.4, files classed as external (third party libraries etc.) can be included in this figure as well as internal files (previous releases never included external files).
View Logs	Clicking this icon will direct you straight to the "Run analysis" log files.
	The search option allows you to filter for specific text. The search functions on the columns File Extensions, Technology/Language and CAST Extensions:
	Click to download the report as a .CSV file. When opened in Microsoft Excel (or equivalent), two tabs are available: Source Files Analysis Summary : displays an overview, i.e. the same data available in Console UI. Details: displays a list of files with their primary file extension, their technology, the list of CAST extensions that support the technology, and the status (excluded, analyzed, not analyzed).

Clicking a number in the list will open a popup with more details about the files:

To make results easy to use, some files are ignored and are not listed in this report:

all files with extensions that are not associated directly to a programming language (all resources or data languages for example, or project files like xml, http or json).
all files with patterns such as .git, .svn, node-modules, org-eclipse, CCAU\.abap, IP\.abap
special files like package-info.java, *CT.abap, *CP.abap, hh, h++, hpp, hcc, h, hxx, ph
files resulting from CAST Datbase extractions such as castextraction or uaxdirectory, because they are not currently directly associated with a language or extension.

Analysis Results Indicators

This section is only displayed:

in Console ≥ 2.8.
AND when an analysis has been actioned.

Some indicators require just an analysis to be run and some require a snapshot as well. This is noted in the Available Indicators table below.

This section displays a set of indicators for a given analysis/snapshot. These indicators are designed to provide basic information quickly so that the analysis/snapshot can be validated. The indicators are generated during the analysis/snapshot in a dedicated step and can be generated on-demand manually (see below):

The feature can be disabled if required - see Configuring Indicators.
You can enable and disable individual indicators in Administration Center - Settings - Analysis Results Indicators - this requires the global "Admin" role.

Click to enlarge

Categories filter	This drop down filters the Indicators in the list by category. By default, all categories are displayed in the list.
Update banner	This banner is displayed when Console detects that a configuration change has been made and that your data should be updated. If the "Update" button is clicked, then a job will run to ensure that all Analysis Results Indicator data is correct. The triggers for this banner are identical to the triggers described in the section Update Banner in Application - Config.
Show all indicators	By default this toggle switch is disabled, which means only Indicators that have a positive value (displayed in the Value column) will be displayed. All indicators which have "N/A" in the Value column will be hidden. Enable the option to show all Indicators regardless of their Value.
Snapshot selector	Choose the snapshot you would like to view indicators for. By default the most recent snapshot for the Application will be displayed.
Search	Use this to search on the Indicator name.
Download report	This option enables you to download Microsoft Excel reports containing detailed information about the indicators in each category: If All Categories is selected (see option above) then a ZIP file will be downloaded containing the relevant XLSX files - one per category If a specific category is selected, then a XLSX file will be downloaded. The file name used for the ZIP file and the XLSX files will contain a time stamp using the following format: `<year><month><day>_<hour><minute><second>`. The time stamp is generated when the Download button is clicked. Excel file report contents The first sheet has information related to application name, snapshot name, snapshot date and category for which this report is generated. It also contains a summary for all the indicators belonging to that category i.e. name, description, thresholds, value, status, details, remedy action and justification. The indicator value is computed along with status which is a star rating based on the thresholds of that indicator. The details column contains the hyperlink to the details sheet of that indicator.
Recompute indicators	This option enables you to recompute the indicators without needing to generate an entire new analysis/snapshot. The option is only available when the most recent analysis/snapshot is selected in the snapshot selector Justification entered for the indicators is retained after recomputation Any actions that modify analysis data will be reflected in the analysis/snapshot indicator results after recomputation. Note that this button is hidden if the Update Banner (described above) is displayed).
Indicator	See list of available indicators below for more information.
Value	The value generated for the current snapshot. Can be a ratio or a percentage. For some indicators when only one snapshot exists, the value may be N/A, for example: for indicators measuring the variation between two snapshots, the value will be N/A on the first snapshot for the Large SCC count indicator the value can be N/A when no option is set in the Analysis schema to count the large SCC, so the indicator can not be calculated.
Status	Status of the indicator - the more stars the better the results. Rolling the mouse over the stars will show the thresholds required to improve:
Justification	Justifications can only be edited for the most recent snapshot. If the snapshot selector is changed to a historic snapshot, the field becomes read-only. A free text field enabling you to enter a justification for the result. Free text is saved and is retained for the next snapshot that is generated. For example: Do you agree? Is the coverage as expected? ≥ 2.9 Use the icon to add a new justification explanation: And enter the justification in the pop-up: The icon changes to indicate a justification has been added: Older releases Enter the justification in the field itself.
Remedy Action	The Remedy Action provides a suggestion for how to improve the result in the next analysis/snapshot. Any links are clickable. ≥ 2.9 Remedies are displayed in line: If they are larger than the available space, rolling the mouse over them will display the full text in a popup: Older releases Click the icon to display the full text of the remedy:
Details	Some indicators store results in a CSV file - click this option to download the CSV file. This can help you work out why a poor result has been produced, for example. CSV files are generated and stored in the following locations: ≥ 2.2.0 \\share\aip-node-data\common-data\snapshot-indicator\{appGuid}\{snapshotGuid} ≤ 2.1.0 - on the Node %PROGRAMDATA%\CAST\AipConsole\AipNode\snapshot-indicator\{appGuid}\{snapshotGuid}

Clickable Indicators

Some Indicators are clickable: clicking the link will take you to the relevant configuration page within Console:

Available Indicators

Click here to expand...

Requires snapshot or analysis?	Indicator Name	Description	Stars/Threshold	Details in CSV file	Remedy Action
Snapshot	Artifacts in transactions variation	Variation in percentage of artifacts involved in transactions compared to the previous snapshot.	3: <=3% 2: >3% and <= 5% 1: >5% and <=7%	-	Review the source code delivery with regards to the transaction configuration. If the value is not within the required range, then you should review the transactions configuration, identify entry and end points, identify missing links or provide justification on objects in technical side if they are actually valid. If they are invalid, then take necessary actions to include them as valid.
Snapshot	Objects not in Dashboard Service	Percentage of objects created in the Analysis Service that have not been transferred to the Dashboard Service.	3: <=5% 2: >3% and <= 10% 1:>10% and <=15%	-	Check the definition of user-defined modules to ensure that objects have not been missed. If they are required in Dashboard Service, then add them to a module.
Snapshot	Entry Points moved to technical part	Percentage of transactions that were considered as functional and that are now considered as technical. Associated details contain the transactions that led to TF and that does not now.	3: =0% 2: >0% and <10% 1:>=10% and <=20%	List of transactions that were in functional part and that are now in technical part.	Check if links are broken during rescan due to change in source code or due to deleted artifacts.
Analysis only	Unexpected objects count	Percentage of objects related to third-party libraries or that are generated by analysis tools captured by modules. These objects are identified by finding any of the following tags in their comments: generated by, generated on, generated code copyright, (c) MIT License License: MIT Apache license, licensed to Apache software foundation General Public License, GPL, GNU creative commons	3: =0% 2: >0% and <=5% 1: >5% and <=10% - : >10%	Associated details contain third-party objects and generated objects that have been captured by modules.	Review suspicious objects and decide if they must be excluded from analysis scope.
Snapshot	Unreferenced objects variation	Variation in number of not-referenced objects. such as followings: Classes Code ( ASP) Forms Functions Includes Interfaces JSP pages Modules Files	3: <3% 2: >=3% and <= 4% 1:<5%	-	Justify the variation between 2 snapshots that could be due to added or deleted code which is unreferenced. Another reason could be missing links or new links between objects when compared to previous version.
Snapshot	Incomplete Transaction Variation	Variation in percentage of transactions that are incomplete, compared to the previous snapshot.	3: <=1% and >=-1% 2: ( >=-2% and < -1%) Or (>1% and <=2%) 1: (>-3% and < -2%) Or ( >2% and <3%)	-	Check if entry points and/or end points have been added or removed in new version of source code due to added/removed files or have been added/removed manually. Check if entry points and/or end points have been added or removed in new version of source code due to added/removed files or have been added/removed manually. You can also check if transaction call graphs have been impacted by added or missing links.
Analysis only	Dynamic Links reviewed	Percentage of Dynamic Links that have been reviewed.	3: >=95% 2: >=70 and <95% 1: >=50% and <70	-	Check if Automatic Link Validator Extension is installed. Review DL manually or define filtering rules to be applied at analysis time. To review manually see: Application - Config - Summary of Dynamic Links To define rules: Application - Config - Dynamic Links Rules
Analysis only	Technologies not interacting with others	Technologies not interacting with others	3: =0 2: N/A 1: N/A	List of technologies not interacting with others	Review source code delivery, analysis configuration, and the cause for potential missing links.
Snapshot	Technology wise LOC - No Change	Percentage of technologies involved in the application for which there is a lack of variation in LoC compared to the previous version. Associated details contains the list of technologies with no changes in LOC.	3: =0% 2: >0% and < 20% 1: >=20% and <30%	The list of technologies with no changes in LOC.	Check if it is normal to not have any variation in LoC for the technologies involved in the application. This can denote an issue during the version delivery.
Snapshot	Databases variation	Indicates whether the list of the databases that are accessed by the application has changed since the previous snapshot	3 : databases are the same in the 2 snapshots 2 : N/A 1 : N/A - : one/some databases have been added, removed, or renamed	Databases that have been added and/or those that have been removed since the previous snapshot; databases that have been renamed or whose host instance has changed will be listed as added/deleted	Justify the root cause of databases' list change.
Snapshot	LoC variation (technology level)	Variation in the number of LoC by technology.	Below, the % retained for rating is the biggest one (in absolute value) among all technologies whose number of LoC has changed: 3 : >=-20% and <=20% 2 : (>=-30% and <-20%) or (>20% and <=30%) 1 : (>=-40% and <-30%) or (>30% and <=40%) - : <-40% or >40%, or a technology that was used in the previous snapshot isn't used any more	Per technology: whether it was added or removed, or is unchanged, along with the number of LoC in the previous and current snapshots, and the LoC variation value and percentage	Find the root cause of variation and justify. 1. Check if new files are added/deleted in new version of source code for a particular technology. 2. Check if new version of Technology Extension is applied recently which contains some enhancements and capturing more lines of code or vice versa.
Snapshot	LoC variation (file level)	Variation in number of LoC for source files. Associated details contain the source files that have been added or removed since previous version.	3: >=-5% and <=5% 2: =5% or =-5% 1: (>5% and <10% ) or (<-5% and >-10% )	Per file: whether it was added or removed, or is unchanged, along with the number of LoC in the previous and current snapshots, and the LoC variation value and percentage	Review the Release Notes to track changes in analyzers. Find the root cause of variation and justify. Check if new files are added/deleted in new version of source code
Snapshot	Technologies variation	Variation in the number of technologies identified in the source code	3 : technologies are the same in the 2 snapshots 2 : N/A 1 : N/A - : some technologies have appeared and/or some other have disappeared	Technologies that have appeared or disappeared since the previous snapshot	Justify the change. 1. Check with Application team if they have added/removed a new technology. 2. Add appropriate extensions to analyze that newly added technology.
Analysis onkly	Large SCC count	Count of Strongly Connected Components with more than a certain number of objects	3: The 'GRAPH_SAVE_LARGEST_SCC_GROUP' option is set and no large SCC was found during computation of the Transactions' call graphs 2: N/A 1: The 'GRAPH_SAVE_LARGEST_SCC_GROUP' option is not set or its value is 0 (it is not known whether large SCCs exist or not) - : The 'GRAPH_SAVE_LARGEST_SCC_GROUP' option is set and there exists at least one large SCC or The 'GRAPH_SAVE_LARGEST_SCC_GROUP' option is set but its value is not an integer >= 0	The maximum number of objects allowed in an SCC before it is marked as large (the default value is 1000) The maximum number of large SCCs whose objects can be saved for further investigation How many SCCs had their objects saved during the last Function Point computation and what their sizes were	Review links and try to remove extra-links. For more details refers to Troubleshooting guides: Impact of SCC How to check Reduce SCC
Snapshot	AFP variation	Variation in functional weight. Associated details contain the TF and DF that appeared, disappeared, or that have been modified since the previous snapshot.	3: >-5% and <5% 2: =5% or =-5% 1: (>5% and <15% ) or (<-5% and >-15% )	New TF, deleted TF, modified TF New DF, deleted DF, modified DF	Check the transaction configuration rules. Check the source code delivery for new source files and new technologies. Check the source code delivery for missing source files and missing technologies.
Snapshot	LoC per FP variation	Variation in FP density with regards to source code size	3: >-5% and <5% 2: =5% or =-5% 1: (>5% and <15% ) or (<-5% and >-15% )	-	Review source code delivery and transaction configuration. Check if new components arrived in technical part of the application.
Snapshot	Recreated functions	Percentage of functions that disappeared and that reappeared. Associated details contain TF and DF that are recreated.	3: >=0% and <=2% 2:>2% and < 4% 1:>=4% and <=5%	TF and DF that have been deleted and recreated. Note: this is different from Added/Deleted situation in the same snapshot which is when the object ID of the TF/DF has changed because of change in the path of the object for example.	Check the transaction configuration rules. Check if objects have been deleted and then recreated. Check if server part has been correctly delivered and analyzed.
Snapshot	New technical code	Percentage of new objects that belong to the technical side of the application. Associated details contain new objects that are assigned to the technical part of the application.	3: <5%* 3: <5% 2: >=5% and < 10% 1: >=10% and <=15%	New objects that are in technical part.	Validate with application team if new code is functional or technical. Review the transaction configuration accordingly.
Snapshot	Quality rules variation	Variation in number of quality rules. Associated details contain the quality rules that have been added or removed since the previous snapshot.	3: <=0 2: >0 and <5 1: >=5 and <10	QR that have been added or removed since last snapshot	Validate new rules that have been added to the Assessment Model. This could be the consequence of an upgrade (AIP Core and/or extensions). Review the Release Notes to track changes. Check if new files are added/deleted in new version of source code due to which added/deleted metrics are appearing.
Snapshot	Added/Deleted excluded objects count	Count of objects that are excluded from quality rule violations and that present the "added/deleted syndrome". Associated details contain objects excluded from violations and that are also "added/deleted".	3: <=0 2: >0 and <2 1: >=2 and <5	objects that are excluded from rule violations and seen as deleted and re-added	Review the list of deleted/re-added objects and investigate the root cause.
Snapshot	Violation variation per rule	Variation in number of violations per rule, when more than 5 rules with at least 10 added or removed violations. Associated details contain the list of rules with too much variation in number of violations.	3: >-5% and <5% 2: (>=5% and <10% ) or (>=-10% and <-5%) 1: (>=10% and <15%) Or ( >-15% and <=-10%)	List of rules with too much variation in number of violations	Check if new files are added/deleted in new version of source code due to which violations are added/deleted. Check if new version of extension is applied during rescan and whether the new version includes some fixes related to quality for which the variation will be recorded.
Snapshot	AEFP/AEP variation	Variation in ratio between AEFP and AEP.	3: >-5% and <5% 2: =5% or =-5% 1: (>5% and <15% ) or (<-5% and >-15% )	-	Validate with application team the goal of the version. Check if new components or technologies have been added or if existing components or technologies have been removed
Snapshot	Added/Deleted objects variation	Variation in number of objects that present the "added/deleted syndrome". Associated details contain "added/deleted" objects.	3: <=15% 2: >15% and <20% 1: >=20% and <=25%	Objects that have been added and deleted since the previous snapshot.	Check if new files are added/deleted in new version of source code Check if same objects are coming added/deleted that may be due to the change in directory path between 2 versions.
Snapshot	Changeability variation	Variation in grade for the Changeability Business Criterion.	3: >-5% and <5% 2: =5% or =-5% 1: (>=5% and <15% ) or (<-5% and >-15% )	N/A	Check if new source files have been delivered. Check if many changes have been done in the version. Justify the variation that could be due to an increase or decrease in violations for specific rules which could be because of code change or because of missing links or because of module definition.
Snapshot	Robustness variation	Variation in grade for the Robustness Business Criterion.	3: >-5% and <5% 2: =5% or =-5% 1: (>=5% and <15% ) or (<-5% and >-15% )	N/A	Check if new source files have been delivered. Check if many changes have been done in the version. Justify the variation that could be due to an increase or decrease in violations for specific rules which could be because of code change or because of missing links or because of module definition.
Snapshot	Transferability variation	Variation in grade for the Transferability Business Criterion.	3: >-5% and <5% 2: =5% or =-5% 1: (>=5% and <15% ) or (<-5% and >-15% )	N/A	Check if new source files have been delivered. Check if many changes have been done in the version. Justify the variation that could be due to an increase or decrease in violations for specific rules which could be because of code change or because of missing links or because of module definition.
Snapshot	Efficiency variation	Variation in grade for the Performance Business Criterion.	3: >-5% and <5% 2: =5% or =-5% 1: (>=5% and <10% ) or (<-5% and >-10% )	N/A	Check if new source files have been delivered. Check if many changes have been done in the version. Justify the variation that could be due to an increase or decrease in violations for specific rules which could be because of code change or because of missing links or because of module definition.
Snapshot	Security variation	Variation in grade for the Security Business Criterion.	3: >-5% and <5% 2: =5% or =-5% 1: (>=5% and <10% ) or (<-5% and >-10% )	N/A	Check if new source files have been delivered. Check if many changes have been done in the version. Justify the variation that could be due to an increase or decrease in violations for specific rules which could be because of code change or because of missing links or because of module definition.
Snapshot	TQI variation	Variation in grade for the TQI index.	3: >-5% and <5% 2: =5% or =-5% 1: (>=5% and <10% ) or (<-5% and >-10% )	N/A	Check number of new technologies and new objects. Check new rules. Justify the variation that could be due to an increase or decrease in violations for specific rules which could be because of code change or because of missing links or because of module definition.
Snapshot	Critical Violations variation	Variation in number of critical violations. Associated details contain the critical violations that have been added or removed since the previous snapshot.	3: >-5% and <5% 2: =5% or =-5% 1: (>=5% and <10% ) or (<-5% and >-10% )	Critical violations added/removed	Check if new rules have been added to the Assessment Model. Check if new source files have been delivered. Check if new objects have been created. Justify the variation that could be due to an increase or decrease in violations for specific rules which could be because of code change or because of missing links or because of module definition.
Snapshot	Excluded objects variation	Variation in number of objects that are excluded from quality rule violations. Associated details contain the objects that have been excluded from violations.	3: >-5% and <5% 2: =5% or =-5% 1: (>=5% and <15% ) or (<-5% and >-15% )	List of excluded objects	If the variance is +/-5%, then check the excluded objects list and verify if these are real candidates for exclusion.
Analysis only	Artifacts in transactions	Percentage of artifacts involved in transactions. Associated details contain artifacts that are not involved in any transactions.	3: >=50% 2: <50% and >=40% 1: <40% and >=30%	List of artifacts not involved in transactions	Review the source code delivery with regards to the transaction configuration. If percentage not within required range, then AIA needs to review the transactions, identify entry/end points, identify missing links or provide justification on objects in technical side if they are actually valid. If invalid, then take necessary actions to include them as valid.
Snapshot	Complete Transactions with only end point	Percentage of complete transactions with no data entity (only end points). Associated details contain the complete transactions that do not access any data entity.	3: <=30% 2: >30% and <=50% 1: >50% and <=70%	List of complete transactions that do not access any data entity but only end points	Check if data storage part has been delivered. If yes, then check if it is expected to have transactions with no access to these data entities.
Analysis only	Data entities used by transactions	Percentage of data entities accessed by transactions. Associated details contain list of data entities not access by any transaction.	3: >=90% 2: <90% and >=70% 1: <70% and >=50%	List of data entities not accessed by any transaction	Review the source code delivery with regards to the transaction configuration. Check missing links and validate with application team if it is normal these data entities are not accessed by any transactions.
Analysis only	Incomplete transactions	Percentage of incomplete transactions (that do not access any data entity and end point). Associated details contain transactions that does not access any data entity or end point.	3: <= 10% 2: <= 30% and > 10% 1: <= 40% and > 30 %	List of incomplete transactions	Review data entities and associated transaction configuration rules. Investigate the incomplete transactions and justify if they are valid incomplete or not. If possible, add custom end points to make the incomplete transactions valid.
Snapshot	AEFP/AEP (known as "Part of functional enhancement" in v. ≤ 1.18)	Percentage of AEP that are related to the functional part of the application.	3: >= 70% 2: >= 50% and < 70% 1: >= 30% and < 50%	N/A	Validate with application team the goal of the version. Check if new components or technologies have been added or if existing components or technologies have been removed. Add new entry/end points to cover isolated objects in transaction. Check the list of Technical Points and justify if those are actually technical objects.
Analysis only	Programs/Classes in transactions	Percentage of programs and classes involved in transactions. Associated details contain programs and classes that are not involved in any transactions.	3: >= 50% 2: >= 30% and < 50% 1: >=10% and < 30%	List of containers not involved in transactions	Review the source code delivery with regards to the transaction configuration. If the value is not within the required range, then you should review the transactions configuration, Identify entry and end points, identify missing links or provide justification on objects in technical side if they are actually valid. If they are invalid, then take necessary actions to include them as valid.
Snapshot	TF / DF weight Ratio	Ratio between Transactional Functions weight and Data Functions weight. Associated details contain DF that are not involved in any TF.	3: >=2 and <4 2: ( >=1 and <2 ) or (>=4 and <5) 1: (>0 and <1) or (>=5 and <6)	List of DF that are not used by any TF.	Check transaction configuration rules. Review incomplete transactions if any. Review DF that are not used by any TF.

Technical information about Indicators

When a snapshot is deleted all the indicators for the snapshot along with the generated CSV files are deleted. In addition, the consolidation action launched when a snapshot is deleted will only deal with Dashboard schema indicators for the next two snapshots if they exist. During consolidation, any justification text is retained for each indicator.
Snapshot Indicators are also deleted when a version and an application are deleted.

Logging information about Indicators

Click here to expand...

Log for the Indicator step:

Click to enlarge

Log for consolidating indicators in delete snapshot step:

Click to enlarge

If one of the indicators fails, Console logs the error and continues computation for the next indicator:

Click to enlarge

If the indicator step fails we log the error and proceed to the next step:

Click to enlarge

Similarly if consolidating indicators fail for a reason we log the error and delete snapshot step is completed successfully. If any indicators are skipped during the process, the log will include information about the reason the indicator has been skipped:

<enabled>false</enabled> : Indicator xx skipped because it is disabled.
<needFplicense>true</needFplicense> : Indicator xxx Skipped because it needs the FP license.
<enhancementMeasure>EFP</enhancementMeasure> : Indicator xx skipped because it needs enhancement measure EFP
<enhancementMeasure>AEP</enhancementMeasure> : Indicator xx skipped because it needs enhancement measure AEP

Advanced Platform Configuration

This section is only displayed if you have configured more than one of either of the following:

Multiple CAST Storage Service/PostgreSQL instances for analysis or Measurement requirements - see Administration Center - Settings - CSS and Measurement settings.
Multiple Nodes (i.e. you are running the enterprise release of Console which allows for multiple Nodes to be configured) - see Administration Center - Nodes.

This allows you to select the specific target CAST Storage Service/PostgreSQL instance (for the database schemas required for the new Application) OR the target Node (for deep analysis requirements). If you do not make a selection - i.e. you leave the options set to "ANY", Console will function in "load balancing" mode and will choose the CAST Storage Service/PostgreSQL or Node automatically:

If you have ALREADY run a deep analysis, the UI will prevent you from choosing a different CAST Storage Service instance or Node for any subsequent analysis related actions.
Load Balancing behaviour, when ANY is selected:
- CAST Storage Service/PostgreSQL
  - For the deep analysis step (result storage), the CAST Storage Service/PostgreSQL instance with the lowest number of CAST related schemas already stored on it will be used.
- Nodes
  - For the initial fast scan, Console will always use "load balancing" mode, which functions as follows:
    - The node running the most recent release of AIP Core will always be used before all others.
    - If there are multiple nodes running the same most recent release of AIP Core, then Console will choose the least busy node.
  - For the deep analysis step, the least busy node running the same release of AIP Core as used for the initial fast scan will be selected.
Node manual selection: only nodes running the same release of AIP Core as used for the initial fast scan of the onboarding process will be made available for selection - this is to prevent analysis errors. This may mean that it is not possible to choose a specific node.

Run analysis

In ≤ 2.7, CAST Imaging MUST be configured Administration Center - Settings - Imaging Settings otherwise the action will fail. This requirement has been removed in ≥ 2.8.

This section provides the following:

Information about the state of the source code
Allows you to start an analysis
Provides an analysis estimation time in hours and minutes. In ≥ 2.6 this estimation is valid for the analysis action and the upload to CAST Imaging (no estimation is given for CAST Dashboard actions). In previous releases, the estimation is only valid for the analysis action.

Information about the state of the source code	Information about the readiness of the delivered source code for analysis is provided based on the initial fast scan: All clear If no "issues" are found then the "all clear" is given: All clear but cannot access CAST Imaging/CAST Dashboards If no "issues" are found, but CAST Imaging/CAST Dashboards are either not configured or not available, the upload to CAST Imaging/CAST Dashboards (snapshot) will not run: Issues found If issues are found, then a warning is given with an explanation. In this situation, a warning does not mean that the analysis cannot proceed, however, coherent results may not be produced. For example: Console is warning that the delivered source code has links from JSP to Java, however, no Java source has been delivered: Console is warning that the delivered source code contains files that are encoded in a format other than UTF-8. Files that do not use UTF-8 encoding can cause issues for some CAST analyzers and may even cause the analyzer to crash, as such this warning invites you to convert the non UTF-8 files into UTF-8. CAST also provides a breakdown of the technologies which contain non UTF-8 by clicking the link highlighted below (a popup is displayed containing the breakdown): Analysis complete When an analysis has been run, this panel will show: the previous analysis duration time whether any missing dependencies were detected in your source code during the analysis (i.e. code that is calling another piece of code that cannot be found): a yellow warning icon will be displayed if this is the case. This should be fully investigated and corrected because it means that results may not be coherent. Clicking the warning triangle will direct you straight to the log file to see the missing dependencies alerts. See also Validate dependency configuration. a failed analysis, suggesting log files are checked before clicking Resume Analysis:
Run Analysis	Click the Run Analysis button to start the deep analysis process. A popup will then be displayed: When an analysis is started, a full backup of the onboarding details (e.g. delivered source code and any exclusions that have been set) and is created (in ZIP format) and is stored in the following locations (see below). This is so that any manually or automatically (via a filter) excluded folders/files can be removed before the analysis is started. When the analysis action is complete, any excluded files/folders are put back in the original location (ZIP file unzip location or source code folder location): Enterprise mode > SHARED_FOLDER (common-data) location in the docker-compose.yml file - usually similar to \\shared\console\common-data\backup\source_folder_backups Standalone mode > %PROGRAMDATA%\CAST\AIP-Console-Standalone\shared\backup\source_folder_backups
Deep analysis estimation time	The deep analysis estimation time is provided in hours and minutes and is based on anonymous statistical data that has been collected by CAST using the Allow CAST to automatically collect anonymous statistical data option in the Admin Center - see Administration Center - Settings - CAST Extend. Note that this estimation is only valid for the analysis action and does not include any other actions that may have been enabled for CAST Dashboards/Imaging.
	Available in ≥ 2.8. Enabled only when an initial deep analysis has been completed. This option allows you to control what steps in the analysis process are actioned and should only be used if you know what you want to achieve:

What steps are actioned when Run Analysis is clicked?

When the Run Analysis button is clicked, the following will occur automatically depending on the configuration:

CAST Imaging configured and available	Embedded CAST Dashboards configured and available	Analysis	Upload to CAST Imaging	Security Dataflow actioned	Snapshot generation	Upload to CAST Dashboards

Install, Configure, Analyze

The actions Install, Configure and Analyze are ALWAYS actioned regardless of your configuration:

The Finalizing Analysis entry will only be visible in the Analyze section when source code exclusions have been configured. This step restores the excluded files after the analysis has completed:

Upload

The Upload action differs depending on your configuration:

Configuration	Requirement	Actions
Any (Standard AIP Core, AIP Core for Imaging, AIP Core for Security)	CAST Imaging MUST be configured in Administration Center - Settings - Imaging Settings and accessible.	Upload to CAST Imaging will be actioned.
With embedded Dashboards	Embedded CAST Dashboards MUST be configured and accessible. See Embedded CAST Dashboard deployment process.	A snapshot is generated (for the Engineering Dashboard) Data is also uploaded to the Measure schema for the Health Dashboard

Additional analysis options

Depending on the configuration and license in use the following configuration will also be automatically applied when the Run Analysis button is clicked:

Option name

Target

Action

Security Dataflow

CAST Dashboards

This option focuses on user input security assessments for JEE/NET technologies. Selecting this option will:

install the following extensions (in addition to any that are discovered, set to force install or those that are automatically active / shipped extensions):
- com.castsoftware.qualitystandards
- com.castsoftware.automaticlinksvalidator
- com.castsoftware.securityforjava (JEE only)
- com.castsoftware.jeerules (JEE only)
- com.castsoftware.dotnetweb (.NET only)
enable the following options:
- Application - Security Dataflow for the discovered technologies (JEE and/or .NET)

This configuration is applied as follows:

for an initial analysis, if the CAST Dashboards are configured and available this configuration is ENABLED.
for all subsequent analyses, the configuration is enabled/disabled depending on the configuration set in the previous analysis. This behaviour is overridden when the settings in Application - Security Dataflow are manually disabled.

Function Points

CAST Dashboards

This option focuses on function points measurement. Selecting this option will currently install the following extensions (in addition to any that are discovered, set to force install or those that are automatically active / shipped extensions):

com.castsoftware.automaticlinksvalidator

If you are using a CAST global license that does not include EFP, then this option will not produce any results.

Tags for Data Access Sensitivity

CAST Imaging and CAST Dashboards

This option focuses on flow of data identification and will deliver associated results. Selecting this option will currently install the following extensions (in addition to any that are discovered, set to force install or those that are automatically active / shipped extensions):

GDPR / PCI DSS

Two additional options specifically enable a check of a set of predefined sensitive key words related to GDPR (General Data Protection Regulation) and/or PCI-DSS (Payment Card Industry Data Security Standards) data:

These options are ONLY currently taken into account for Mainframe technologies (analyzed via the com.castsoftware.mainframe, SQL technologies (analyzed via the com.castsoftware.sqlanalyzer extension) and NoSQL technologies (analyzed via the com.castsoftware.nosqljava and com.castsoftware.nosqldotnet extensions).
These options do not provide a certification for GDPR and PCI DSS. Their aim is to help identify sensitive data in particular contexts.
It is still possible to provide your own custom key word indicators, see Data Sensitivity for more information.

In other words, enabling the GDPR option (for example) will force the check using the predefined keywords. When the analysis runs, the predefined keywords defined will be checked and if any are found in the source code a flag will be added in the analysis results on the object in question. This can be seen as below in CAST Imaging:

Click to enlarge

Resuming interrupted jobs

Should your job be interrupted for whatever reason (network issue, issue on the Node etc.), CAST Console is able to resume the job from the same point or a previous point. Take for example a job that has been interrupted in the Install step:

Returning to the Application - Overview with Fast Scan page, a Resume button will be displayed in place of Run analysis:

In addition starting CAST Console 2.9, steps that were successfully completed prior to the interruption will be displayed as follows:

Log panel	Click to enlarge
Job progress screen ≥ 2.9	Click to enlarge

Technical details for resume functionality

Click here to expand...

For each step listed below, CAST Console will attempt to resume either from the same step or a previous step:

resume from the same step it failed or was stopped
resume from a previous step

E.g.:

Fast Scan
- Unzipping source
- Initialize fast scan
- Content discovery
Install
- Exclude files
- Create application schemas
- Set up Management database - resume from 'Create application schemas'
- Declare application in Management database - resume from 'Create application schemas'
- Install extensions
Configure
- Creating package from source - refresh onboarding, Prepare Version and resume from 'Content discovery'
- Attaching package to version - refresh onboarding, Prepare Version and resume from 'Content discovery'
- Delivering version - refresh onboarding, Prepare Version and resume from 'Content discovery'
- Accepting Version - refresh onboarding, Prepare Version and resume from 'Content discovery'
- Set as current version
Analysis

- Run analysis
- Prepare analysis data
Upload
- Create snapshot
- Generate snapshot indicators
- Publish to Health Dashboard
- Upload to CAST Imaging

Limitations

The resume functionality is available based on the status of the last executed job, therefore if the analysis has been stopped manually:

and a new extension is added (but not installed), in order to continue the analysis the Resume button should be used so that the "update extension" step is actioned before the analysis step is resumed.
and a new extension is installed, when the install extension action is complete the Resume button will be replaced by Run analysis.

Page tree

Application - Overview with Fast Scan

Introduction

Access

Overview panel

Header

Zip Content/Folder Content

Software Composition

Architecture Preview

Identified Frameworks

Analysis Reports

Analysis Results Indicators

Clickable Indicators

Available Indicators

Technical information about Indicators

Logging information about Indicators

Advanced Platform Configuration

Run analysis

What steps are actioned when Run Analysis is clicked?

Install, Configure, Analyze

Upload

Additional analysis options

Resuming interrupted jobs

Technical details for resume functionality