Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
1. Fundamentals and Scope of Static Code Analysis
- Key definitions: static analysis, SAST, rule classifications, and severity levels.
- The role of static analysis in a secure SDLC and the extent of risk coverage.
- Positioning SonarQube within security frameworks and developer workflows.
2. SonarQube Overview: Capabilities and Architecture
- Essential components: core services, database, and scanner elements.
- Best practices for Quality Gates, Quality Profiles, and governance.
- Security-focused features: vulnerability detection, SAST rules, and CWE mapping.
3. Navigating the SonarQube Server Interface
- Overview of the server UI: projects, issues, rules, metrics, and governance dashboards.
- Analyzing issue details, tracking traceability, and following remediation advice.
- Generating and exporting comprehensive reports.
4. Configuring SonarScanner with Build Tools
- Installation and setup for Maven, Gradle, Ant, and MSBuild.
- Optimizing scanner properties, managing exclusions, and handling multi-module projects.
- Creating necessary test data and coverage reports to ensure analysis accuracy.
5. Azure DevOps Integration
- Establishing SonarQube service connections within Azure DevOps.
- Incorporating SonarQube tasks into Azure Pipelines and utilizing PR decorations.
- Importing Azure Repos into SonarQube and automating the analysis process.
6. Project Settings and Third-Party Analyzers
- Selecting project-level Quality Profiles and rules for Java and Angular.
- Managing third-party analyzers and understanding the plugin lifecycle.
- Configuring analysis parameters and managing parameter inheritance.
7. Roles, Responsibilities, and Secure Development Methodology
- Defining role segregation: developers, reviewers, DevOps engineers, and security leads.
- Developing a matrix of roles and responsibilities for CI/CD operations.
- Evaluating and refining existing secure development methodologies.
8. Advanced Topics: Rule Management and Security Enhancements
- Leveraging the SonarQube Web API to create and manage custom rules.
- Refining Quality Gates and enforcing automated policies.
- Strengthening server security and implementing access control best practices.
9. Applied Hands-on Labs
- Lab A: Set up SonarScanner for five Java repositories (including Quarkus where relevant) and evaluate outcomes.
- Lab B: Configure Sonar analysis for an Angular front-end application and review findings.
- Lab C: Execute a full pipeline integration, connecting SonarQube with Azure DevOps and activating PR decorations.
10. Testing, Troubleshooting, and Report Analysis
- Techniques for generating test data and measuring code coverage.
- Resolving common errors related to scanners, pipelines, and permissions.
- Interpreting and presenting SonarQube reports to both technical and non-technical stakeholders.
11. Best Practices and Strategic Recommendations
- Selecting rule sets and implementing incremental enforcement strategies.
- Optimizing workflows for developers, reviewers, and build pipelines.
- Planning for the scalability of SonarQube in enterprise settings.
Summary and Future Steps
Requirements
- A solid grasp of the software development lifecycle.
- Practical experience with version control systems and fundamental CI/CD principles.
- Proficiency in either Java or Angular development environments.
Target Audience
- Software developers working with Java, Quarkus, or Angular.
- DevOps and CI/CD engineers.
- Security specialists and application security auditors.
Testimonials (1)
Engaging, and hands on practise.
