Application - Overview with Fast Scan - Advanced Platform Configuration

This section is only displayed if you have configured more than one of either of the following:

This allows you to select the specific target PostgreSQL instance (for the database schemas required for the new Application) OR the target Node (for deep analysis requirements). If you do not make a selection - i.e. you leave the options set to “ANY”, Console will function in “load balancing” mode and will choose the PostgreSQL or Node automatically:

Run analysis

This section provides the following:

  • Information about the state of the source code
  • Allows you to start an analysis
  • Provides an analysis estimation time in hours and minutes. In ≥ 2.6this estimation is valid for the analysis action and the upload to CAST Imaging (no estimation is given for CAST Dashboard actions). In previous releases, the estimation is only valid for the analysis action.
Information about the state of the source code

Information about the readiness of the delivered source code for analysis is provided based on the initial fast scan:

All clear

If no "issues" are found then the "all clear" is given:

All clear but cannot access CAST Imaging/CAST Dashboards

If no "issues" are found, but CAST Imaging/CAST Dashboards are either not configured or not available, the upload to CAST Imaging/CAST Dashboards (snapshot) will not run:

Issues found

If issues are found, then a warning is given with an explanation. In this situation, a warning does not mean that the analysis cannot proceed, however, coherent results may not be produced. For example:

  • Console is warning that the delivered source code has links from JSP to Java, however, no Java source has been delivered:

  • Console is warning that the delivered source code contains files that are encoded in a format other than UTF-8. Files that do not use UTF-8 encoding can cause issues for some CAST analyzers and may even cause the analyzer to crash, as such this warning invites you to convert the non UTF-8 files into UTF-8. CAST also provides a breakdown of the technologies which contain non UTF-8 by clicking the link highlighted below (a popup is displayed containing the breakdown):

Analysis complete

When an analysis has been run, this panel will show:

  • the previous analysis duration time
  • whether any missing dependencies were detected in your source code during the analysis (i.e. code that is calling another piece of code that cannot be found): a yellow warning icon will be displayed if this is the case. This should be fully investigated and corrected because it means that results may not be coherent. Clicking the warning triangle will direct you straight to the log file to see the missing dependencies alerts. See also Validate dependency configuration.

  • a failed analysis, suggesting log files are checked before clicking Resume Analysis:

Run Analysis

Click the Run Analysis button to start the deep analysis process. A popup will then be displayed:

Deep analysis estimation timeThe deep analysis estimation time is provided in hours and minutes and is based on anonymous statistical data that has been collected by CAST using the Allow CAST to automatically collect anonymous statistical data option in the Admin Center - see Administration Center - Settings - CAST Extend. Note that this estimation is only valid for the analysis action and does not include any other actions that may have been enabled for CAST Dashboards/Imaging.

Advanced configuration


This option allows you to control what steps in the analysis process are actioned and should only be used if you know what you want to achieve:

What steps are actioned when Run Analysis is clicked?

When the Run Analysis button is clicked, the following will occur automatically depending on the configuration:

CAST Imaging configured and availableEmbedded CAST Dashboards configured and availableAnalysisUpload to CAST ImagingSecurity Dataflow actionedSnapshot generationUpload to CAST Dashboards
✅✅✅✅✅
✅✅✅✅
✅✅
✅
Install, Configure, Analyze

The actions Install, Configure and Analyze are ALWAYS actioned regardless of your configuration:

Upload

The Upload action differs depending on your configuration:

ConfigurationRequirementActions

Any (Standard AIP Core, AIP Core for Imaging, AIP Core for Security)

CAST Imaging MUST be configured in Administration Center - Settings - Imaging Settings and accessible.
  • Upload to CAST Imaging will be actioned. 

With embedded DashboardsEmbedded CAST Dashboards MUST be configured and accessible. See Embedded CAST Dashboard deployment process.
  • A snapshot is generated (for the Engineering Dashboard)
  • Data is also uploaded to the Measure schema for the Health Dashboard

Additional analysis options

Depending on the configuration and license in use the following configuration will also be automatically applied when the Run Analysis button is clicked:

Option nameTargetAction
Security DataflowCAST Dashboards

This option focuses on user input security assessments for JEE/NET technologies. Selecting this option will:

This configuration is applied as follows:

  • for an initial analysis, if the CAST Dashboards are configured and available this configuration is ENABLED.
  • for all subsequent analyses, the configuration is enabled/disabled depending on the configuration set in the previous analysis. This behaviour is overridden when the settings in Application - Security Dataflow are manually disabled.
Function PointsCAST Dashboards

This option focuses on function points measurement. Selecting this option will currently install the following extensions (in addition to any that are discovered, set to force install or those that are automatically active / shipped extensions):

Tags for Data Access Sensitivity

CAST Imaging and CAST Dashboards

This option focuses on flow of data identification and will deliver associated results. Selecting this option will currently install the following extensions (in addition to any that are discovered, set to force install or those that are automatically active / shipped extensions):

GDPR / PCI DSS

Two additional options specifically enable a check of a set of predefined sensitive key words related to GDPR (General Data Protection Regulation) and/or PCI-DSS (Payment Card Industry Data Security Standards) data:

In other words, enabling the GDPR option (for example) will force the check using the predefined keywords. When the analysis runs, the predefined keywords defined will be checked and if any are found in the source code a flag will be added in the analysis results on the object in question. This can be seen as below in CAST Imaging:

Click to enlarge

Resuming interrupted jobs

Should your job be interrupted for whatever reason (network issue, issue on the Node etc.), CAST Console is able to resume the job from the same point or a previous point. Take for example a job that has been interrupted in the Install step:

Returning to the Application - Overview with Fast Scan page, a Resume button will be displayed in place of Run analysis:

In addition starting CAST Console 2.9, steps that were successfully completed prior to the interruption will be displayed as follows:

Log panelClick to enlarge
Job progress screen ≥ 2.9Click to enlarge
Technical details for resume functionality

Click here to expand…

For each step listed below, CAST Console will attempt to resume either from the same step or a previous step:

  • resume from the same step it failed or was stopped
  • resume from a previous step

E.g.:

  • Fast Scan

    • Unzipping source
    • Initialize fast scan
    • Content discovery

  • Install

    • Exclude files
    • Create application schemas
    • Set up Management database - resume from ‘Create application schemas’
    • Declare application in Management database - resume from ‘Create application schemas’
    • Install extensions

  • Configure

    • Creating package from source - refresh onboarding, Prepare Version and resume from ‘Content discovery’
    • Attaching package to version - refresh onboarding, Prepare Version and resume from ‘Content discovery’
    • Delivering version - refresh onboarding, Prepare Version and resume from ‘Content discovery’
    • Accepting Version - refresh onboarding, Prepare Version and resume from ‘Content discovery’
    • Set as current version

  • Analysis

    • Run analysis
    • Prepare analysis data

  • Upload

    • Create snapshot
    • Generate snapshot indicators
    • Publish to Health Dashboard
    • Upload to CAST Imaging

Limitations

The resume functionality is available based on the status of the last executed job, therefore if the analysis has been stopped manually:

  • and a new extension is added (but not installed), in order to continue the analysis the Resume button should be used so that the “update extension” step is actioned before the analysis step is resumed.
  • and a new extension is installed, when the install extension action is complete the Resume button will be replaced by Run analysis.