Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
1. Fundamentals and Scope of Static Code Analysis
- Key definitions: static analysis, SAST, rule categories, and severity levels.
- The role of static analysis in the secure SDLC and risk mitigation.
- How SonarQube integrates with security controls and developer workflows.
2. SonarQube Overview: Features and Architecture
- Essential services, database structure, and scanner components.
- Best practices for Quality Gates, Quality Profiles, and their configuration.
- Security-specific features: vulnerability detection, SAST rules, and CWE mapping.
3. Navigating and Utilizing the SonarQube Server UI
- A comprehensive tour of the Server UI: projects, issues, rules, metrics, and governance views.
- Analyzing issue pages, tracing issues, and following remediation guidance.
- Options for generating and exporting reports.
4. Configuring SonarScanner with Build Tools
- Setup procedures for SonarScanner using Maven, Gradle, Ant, and MSBuild.
- Best practices for scanner properties, file exclusions, and handling multi-module projects.
- Generating required test data and coverage reports to ensure accurate analysis.
5. Integration with Azure DevOps
- Establishing SonarQube service connections within Azure DevOps.
- Incorporating SonarQube tasks into Azure Pipelines and utilizing PR decoration.
- Importing Azure Repos into SonarQube to automate analysis processes.
6. Project Configuration and Third-Party Analyzers
- Setting project-level Quality Profiles and selecting rules for Java and Angular.
- Managing third-party analyzers and understanding the plugin lifecycle.
- Defining analysis parameters and managing parameter inheritance.
7. Roles, Responsibilities, and Secure Development Methodology Review
- Defining role segregation: developers, reviewers, DevOps, and security owners.
- Developing a roles and responsibilities matrix for CI/CD processes.
- Reviewing and recommending improvements to existing secure development methodologies.
8. Advanced Topics: Adding Rules, Tuning, and Enhancing Global Security Features
- Leveraging the SonarQube Web API to add and manage custom rules.
- Refining Quality Gates and enforcing automated policies.
- Enhancing SonarQube server security and implementing access control best practices.
9. Hands-on Lab Sessions (Practical Application)
- Lab A: Configure SonarScanner for five Java repositories (including Quarkus where applicable) and review results.
- Lab B: Set up Sonar analysis for one Angular front-end project and interpret findings.
- Lab C: Comprehensive pipeline lab—integrate SonarQube with an Azure DevOps pipeline and enable PR decoration.
10. Testing, Troubleshooting, and Report Interpretation
- Techniques for generating test data and measuring coverage.
- Addressing common issues and troubleshooting scanner, pipeline, and permission errors.
- Guidance on reading and presenting SonarQube reports to both technical and non-technical stakeholders.
11. Best Practices and Recommendations
- Selecting rule sets and strategies for incremental enforcement.
- Workflow recommendations for developers, reviewers, and build pipelines.
- A roadmap for scaling SonarQube in enterprise environments.
Summary and Next Steps
Requirements
- A solid grasp of the software development lifecycle.
- Practical experience with source control and foundational CI/CD concepts.
- Familiarity with Java or Angular development environments.
Target Audience
- Developers working with Java, Quarkus, or Angular.
- DevOps and CI/CD engineers.
- Security engineers and application security reviewers.
Testimonials (1)
Engaging, and hands on practise.
