Feature Requests

Coming from a customer request, they would like the ability to perform similar policy-based STO enforcement on their NexusIQ scans. They would also like a template-step experience for it as well. https://developer.harness.io/docs/security-testing-orchestration/sto-techref-category/sonarqube-sonar-scanner-reference/#view-sonarqube-code-coverage-results https://help.sonatype.com/en/policy-violation-rest-api.html

In harness STO, user is not able to raise the multiple exemptions at once if there is more than one vulnerability in a pipeline.

We have done STO Sonar integration for our dotnet services and it has been working fine. We are trying to do the same for our windows services, but I'm getting the below error in the Initialize step, 'Back-off pulling image " gcr.io/gcr-prod/harness/sto-plugin:latest "' As suggested in the ticket ( https://support.harness.io/hc/en-us/requests/63663 ), I'm applying Ingestion method for the Sonar and Veracode STO evaluations. https://app.harness.io/ng/account/H6rHO8vtQYKelD_wgjnMpA/all/orgs/AODevSecOps/projects/SandBox/pipelines/POCWindows2/executions/QiCniWtjS5WGL9vP_xAvJA/pipeline?storeType=INLINE Later, we came to know that STO ingestion with Windows OS is only supported when you run the build on Harness cloud. But we are running on our own k8s cluster. Hence I'm submitting this feature request to get the STO support for windows. Regards, Janish

Burpsuite Enterprise offers two authentication methods, "Credential Login (Username/Password)" and "Recorded Login" Harness currently is supporting the credential login method, A feature for using "Recorded Login" while initiating the scan from Harness will be useful where a normal authentication method is not working. As almost 50% of the applications are only working with "Recorded Logins"

We would like to see JForg Xray security tests step in Harness as out of the box capabilities for docker and file type artifact scan.

Invicti is globally used by us. We would appreciate DAST Scanning support in Harness. https://www.invicti.com/

Anchore has a toggle that lets users filter out vulnerabilities that the vendor disagrees with or does not intend to prioritize for remediation. We use this to prioritize engineering effort for fixes and also exclude vulnerabilities from gating regardless of their severity. This is a toggle switch in the UI (see screenshot) and a parameter on the command line ( anchore image vulnerabilities --vendor-only ). The API uses a vendor_only parameter in the /images/{image_digest}/vuln/{vuln_type} endpoint which can be set to "true" or "false". (API reference: https://docs.anchore.com/current/docs/api/v2/reference/ )

STO Prisma step currently only ingests vulnerability results and NOT compliance results (despite Prisma producing both). In Prisma console, we have CI threshold configured to fail on HIGH and CRITICAL findings for Vulnerabilities and Compliance. In Harness, we found that in order to ensure build fails, we need to set threshold on the step within Harness. I set this threshold to HIGH. However we are finding that Harness is only ingesting vulnerability findings and not compliance findings. The Prisma scan will fail for compliance (which can be seen printed in output), but because Harness does not read compliance findings it is not failing the build nor populating the compliance items into security tab. Desired outcome: Both vulnerability and compliance findings are ingested by Harness, populated to Security tab, and build failure can be tied to vulnerability AND compliance results based on defined threshold.

Need the ability to to pass custom arguments to NexusIQ scan