Interpreting Fortify results file (.fpr) through command line

fortify stig
Gary O' Donoghue picture Gary O' Donoghue · May 13, 2016 · Viewed 10.4k times · Source

As part of automating the process of running secure code analysis, I have a Jenkins job which uses the sourceanalyzer command line tool to generate an .fpr results file. At the moment I'm opening this results file in Audit Workbench application to view the results and check if there's any newly introduced issues etc, and generating a report from there in PDF/XML format.

Does anyone is it possible to invoke Audit Workbench through the command line and generate a report on the issues, which we could then leverage through a Jenkins script and also then mail the results? Looking online the command line usage seems to stop at the fpr generation stage.

Thanks in advance!

Answer

SBurris picture SBurris · May 13, 2016

There is a command-line utility to generate an Report from the FPR file.

Currently there are two report generators: Legacy and BIRT. The BIRT report engine was introduced into Audit Workbench with version 4.40.

Here is an example using the BIRT Report engine to generate a DISA STIG report

BIRTReportGenerator -template "DISA STIG" -source HelloWorld_second.fpr 
    -output BirtReport.pdf -format PDF -showSuppressed --Version "DISA STIG 3.9" 
    -UseFortifyPriorityOrder

Using the legacy one is a little more involved. The command is: 

ReportGenerator -format pdf -f LegacyReport.pdf -source HelloWorld_second.fpr 
    -template DisaStig3.10.xml -showSuppressed -showHidden

You can either use one of the predefined template reports located in the <SCA Install Dir>/Core/config/reports directory or generate one using the Report Wizard and saving the template which gets stored in the C:\Users\<USER>\AppData\Local\Fortify\config\AWB-XX.XX\reports\ directory in Windows.

On Linux/Mac look at the configuration file <SCA Install Dir>/Core/config/fortify.properties for the com.fortify.WorkingDirectory property, this is where the reports will be stored

Related questions

How does Fortify software work?

Fortify is a SCA used to find the security vulnerabilities in software code. I was just curious about how this software works internally. I know that you need to configure a set of rules against which the code will be …

Read More
How to fix "Path Manipulation Vulnerability" in some Java Code?

The below simple java code getting Fortify Path Manipulation error. Please help me to resolve this. I am struggling from long time. public class Test { public static void main(String[] args) { File file=new File(args[0]); } }

Read More
Fortify command line usage

Has anyone used command line to run fortify? I tryin to incorporate fortify run in my CI build and I dont know how to do it.

Read More