blocks|key|4251842|text|如果您正在使用Fortify+SCA，您还应该可以访问Fortify软件安全中心(SSC)。SSC可用于跟踪跨项目生成的趋势数据。SSC内置了根据SSC内部用户定义的事件发送警报的功能；我从未与这些事件一起工作过，因此除了文档所说的之外，无法提供任何其他想法。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4251843|Fortify+SCA+(.fpr文件)生成的报告是存储所有相关数据的zip文件XML文档；我怀疑这些文件中的某些数据与SCA和SSC实例中的SCA规则集相关。我怀疑如果没有规则集，您将能够确定已经引入了新的问题，但是没有任何关于它们是什么、优先级级别等的好数据。|4251844|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

If you are using Fortify SCA, you should also have access to Fortify Software Security Center (SSC). SSC can be used to track trending data across builds of a project. SSC has built in capabilities to send out alerts based on user-defined events within SSC; I have never worked with those so can't offer any thoughts other than what the docs say.

The reports generated by Fortify SCA (.fpr files) are zip files XML documents storing all the relevant data; I would suspect some of the data in those files are related to the SCA rulesets that are present in both SCA and SSC instances. I suspect without the rulesets you would be able to determine that new issues have been introduced, but not any good data on what they are, priority level, etc.

blocks|key|4251864|text|(1)将Fortify报表生成为XML格式的命令:+FORTIFY_INSTALL_DIR\bin\ReportGenerator.bat+-format+xml+-f+target_file_name.xml+-source+your_fpr_file_name.fpr+-template+Detailed+DefaultReportDefinition.xml|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4251865|(2)还可以使用AWB生成..pdf/..rtf/..xml报表(顶部菜单栏)+->保存报表->选择格式->save|4251866|(3)在这里添加了创建excel表的过程：Export+HP+Fortify+SCA+4.10+results+in+EXCEL+format|offset|length|4251867|(4)如果您可以访问DB+(oracle)，则可以使用脚本进行查询。|4251868|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/24908413/export-hp-fortify-sca-4-10-results-in-excel-format/31802453#31802453^0|0|0|L|1E|0|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@$F|U|G|V|1|W]]|A|$]]|$1|H|3|I|5|6|7|X|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|Q]]]]

(1) Command for the Fortify report generation to XML FORMAT:
FORTIFY_INSTALL_DIR\bin\ReportGenerator.bat -format xml -f target_file_name.xml -source your_fpr_file_name.fpr -template Detailed-DefaultReportDefinition.xml 

(2) you can also use AWB to generate the .pdf/.rtf/.xml report by Report(top menu bar) -> save report -> select format ->save 

(3) Just added procedure to create excel sheet here: <a href="https://stackoverflow.com/questions/24908413/export-hp-fortify-sca-4-10-results-in-excel-format/31802453#31802453">Export HP Fortify SCA 4.10 results in EXCEL format</a> 

(4) If you have access to DB (oracle), you can query with script

blocks|key|2591069|text|使用审核工作台运行报告。选择“开发人员工作簿”并禁用除一个部分以外的所有内容。(您可以选择任何您想要的部分)。|type|ordered-list-item|depth|inlineStyleRanges|entityRanges|data|2591070|在report部分的附加属性中，将问题的筛选器设置为[issue+age]:new。这意味着报告将只显示在您的FPR中的问题，这些问题在上一次扫描中没有出现，并且在最近的扫描中被引入。保存模板。|offset|length|style|CODE|2591071|在扫描配置中，确保每个项目每次都扫描到相同的FPR，以便报表运行程序可以计算“新”问题。|2591072|扫描完成后，使用@+use+1836982的回答来运行报告。选择XML模板并以编程方式处理它。|2591073|unstyled|2591074|2591075|entityMap^0|0|Q|F|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|R|8|@$D|S|E|T|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|U|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|V|8|@]|9|@]|A|$]]|$1|L|3|-4|5|M|7|W|8|@]|9|@]|A|$]]|$1|N|3|-4|5|M|7|X|8|@]|9|@]|A|$]]|$1|O|3|-4|5|M|7|Y|8|@]|9|@]|A|$]]]|P|$]]

<ol>
<li>Use Audit Workbench to run a report. Choose "developer workbook" and disable all except one section. (you can choose any section you want).</li>
<li>In the report section's additional properties, set the filter for the issues to <code>[issue age]:new</code>. This means the report will show ONLY issues in your FPR that were not present in the previous scan, and were introduced in the latest scan. Save the template.</li>
<li>In your scan configuration, make sure to scan to the same FPR every time per project, so that "new" issues can be calculated by the report runner.</li>
<li>After the scan is complete, use the answer by @user1836982 to run the report. Choose the XML template and process it programmatically.</li>
</ol>

We have Fortify SCA and we are setting up regular, automated scans of our source code. Our intention is to have an alert if there is an introduced security issue. Is there a way, perhaps using FPRUtility (or some other method) to accomplish this? Ultimately I prefer something that can be easily run from the command line, but if this can also be accomplished using the GUI then I would appreciate knowing how to do that as well.

How to diff Fortify SCA scans

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我们有Fortify SCA，我们正在建立常规的，自动扫描我们的源代码。如果出现了安全问题，我们的意图是保持警惕。是否有一种方法，也许使用FPRUtility (或其他方法)来实现这一点？最终，我更喜欢可以从命令行轻松地运行的东西，但是如果这也可以使用GUI来完成，那么我也希望知道如何这样做。

问如何区分Fortify SCA扫描
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何区分Fortify SCA扫描EN