Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
1. Fundamentals and Scope of Static Code Analysis
- Key Definitions: static analysis, SAST, rule classifications, and severity levels.
- The role of static analysis in a secure SDLC and its risk coverage capabilities.
- How SonarQube integrates with security controls and developer workflows.
2. SonarQube Overview: Features and Architecture
- Core services, database structures, and scanner components.
- Best practices for Quality Gates, Quality Profiles, and governance.
- Security-focused features, including vulnerability detection, SAST rules, and CWE mapping.
3. Navigating and Utilizing the SonarQube Server UI
- A comprehensive tour of the Server UI, covering projects, issues, rules, metrics, and governance views.
- Interpreting issue pages, understanding traceability, and following remediation guidance.
- Options for generating and exporting reports.
4. Configuring SonarScanner with Build Tools
- Setting up SonarScanner for Maven, Gradle, Ant, and MSBuild.
- Best practices for configuring scanner properties, handling exclusions, and managing multi-module projects.
- Generating essential test data and coverage reports to ensure accurate analysis.
5. Integration with Azure DevOps
- Establishing SonarQube service connections within Azure DevOps.
- Incorporating SonarQube tasks into Azure Pipelines and implementing PR decoration.
- Importing Azure Repos into SonarQube and automating analysis processes.
6. Project Configuration and Third-Party Analyzers
- Selecting project-level Quality Profiles and rules for Java and Angular.
- Utilizing third-party analyzers and managing the plugin lifecycle.
- Defining analysis parameters and understanding parameter inheritance.
7. Roles, Responsibilities, and Secure Development Methodology Review
- Defining segregation of roles across developers, reviewers, DevOps, and security owners.
- Developing a roles and responsibilities matrix for CI/CD processes.
- Evaluating and recommending improvements to existing secure development methodologies.
8. Advanced: Adding Rules, Tuning, and Enhancing Global Security Features
- Leveraging the SonarQube Web API to add and manage custom rules.
- Adjusting Quality Gates and enforcing automated policies.
- Best practices for hardening SonarQube server security and managing access control.
9. Hands-on Lab Sessions (Applied Learning)
- Lab A: Configuring SonarScanner for five Java repositories (using Quarkus where applicable) and analyzing the results.
- Lab B: Setting up Sonar analysis for one Angular front-end project and interpreting the findings.
- Lab C: A comprehensive pipeline lab integrating SonarQube with an Azure DevOps pipeline and enabling PR decoration.
10. Testing, Troubleshooting, and Report Interpretation
- Strategies for generating test data and measuring coverage.
- Identifying and resolving common scanner, pipeline, and permission errors.
- Methods for reading and presenting SonarQube reports to both technical and non-technical stakeholders.
11. Best Practices and Recommendations
- Selecting rule sets and implementing incremental enforcement strategies.
- Workflow recommendations for developers, reviewers, and build pipelines.
- Strategic roadmap for scaling SonarQube in enterprise environments.
Summary and Next Steps
Requirements
- A solid grasp of the software development lifecycle.
- Hands-on experience with source control and foundational CI/CD concepts.
- Proficiency with Java or Angular development environments.
Target Audience
- Developers working with Java, Quarkus, or Angular.
- DevOps and CI/CD engineers.
- Security engineers and application security reviewers.
Testimonials (1)
Engaging, and hands on practise.
