Jenkins
This document explains how to integrate Invicti Platform with Jenkins to automate web application security scans within your CI/CD pipeline. By integrating Invicti Platform, you can automatically trigger vulnerability scans as part of your Jenkins builds, ensuring your applications are tested for security issues before deployment. The process involves generating an API token, preparing an automated scan script from Invicti, embedding it into a Jenkins pipeline, and executing it during builds.
Prerequisites
- Docker Pipeline plugin installed in Jenkins
- Docker CLI (docker.io) installed and running on the system
- Java installed
- Invicti Platform account with API Security enabled
- Ensure Docker has access to the Invicti Registry Scan CLI image (registry.invicti.com/...) .To log in, use the following credentials:
- Username: the email address used for logging into Invicti Platform
- Password: your active license key
Step 1: Generate API key
To generate a new API key, follow the instructions in the linked document.
Step 2: Prepare script
- In Invicti Platform, select Integrations from the left-side menu.
- Switch to the Browse integrations tab.
- Select Configure on the Jenkins tile.
- Select an Asset and specify the Scan profile.
- Decide whether to fail the build if specific conditions are met.
- Click Generate script.
Step 3: Generate script
- On the Script generation page, copy the script to the clipboard.
- Click Done to complete the script generation.
When you press Done, you are taken to the My integrations page. Jenkins integrations do not appear in the list. The UI interface is here only to help you get the script that you can embed in your Jenkins pipeline. |
Step 4: Configure Jenkins
- In Jenkins, click New Item.
- Enter a name for your pipeline, specify the item type as Pipeline, and click OK.
- On the left, select the Pipeline tab.
- Paste the script (generated in Step 3: Generate script) into the pipeline field and replace the INVICTI_API_TOKEN placeholder with your API token (copied from Step 1: Generate API token).
- Click Save.
Step 5: Run the pipeline
- Click Build Now.
- The pipeline will pull the Invicti scan CLI image, run the scan, and create a report.
- Review the Console output and download the report if required.
