Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
1. Principles and Scope of Static Code Analysis
- Key definitions: static analysis, SAST, rule categories, and severity levels.
- The role of static analysis in a secure SDLC and risk mitigation.
- Positioning SonarQube within security controls and developer workflows.
2. SonarQube Overview: Capabilities and Architecture
- Essential services, database structure, and scanner components.
- Quality Gates, Quality Profiles, and best practices for their application.
- Security-centric features: vulnerability detection, SAST rules, and CWE mapping.
3. Navigating the SonarQube Server Interface
- Server UI walkthrough: projects, issues, rules, metrics, and governance views.
- Analyzing issue pages, traceability, and remediation guidance.
- Generating and exporting reports.
4. SonarScanner Setup with Build Tools
- Installing SonarScanner for Maven, Gradle, Ant, and MSBuild.
- Best practices for scanner properties, exclusions, and multi-module projects.
- Creating essential test data and coverage reports for precise analysis.
5. Integration with Azure DevOps
- Setting up SonarQube service connections within Azure DevOps.
- Incorporating SonarQube tasks into Azure Pipelines and pull request decoration.
- Importing Azure Repos into SonarQube and automating analysis workflows.
6. Project Configuration and Third-Party Analyzers
- Setting project-level Quality Profiles and selecting rules for Java and Angular.
- Utilizing third-party analyzers and managing the plugin lifecycle.
- Defining analysis parameters and parameter inheritance.
7. Roles, Responsibilities, and Secure Development Methodology Review
- Segregation of duties: developers, reviewers, DevOps, and security owners.
- Developing a roles and responsibilities matrix for CI/CD processes.
- Evaluating and proposing improvements to existing secure development methodologies.
8. Advanced: Rule Management, Tuning, and Global Security Enhancement
- Utilizing the SonarQube Web API to create and manage custom rules.
- Adjusting Quality Gates and enforcing automated policies.
- Strengthening SonarQube server security and access control best practices.
9. Practical Lab Sessions (Applied Skills)
- Lab A: Configure SonarScanner for five Java repositories (using Quarkus where applicable) and review the results.
- Lab B: Set up Sonar analysis for one Angular front-end project and interpret the findings.
- Lab C: Comprehensive pipeline lab—integrate SonarQube with an Azure DevOps pipeline and activate PR decoration.
10. Testing, Troubleshooting, and Report Analysis
- Strategies for generating test data and measuring coverage.
- Resolving common issues related to scanners, pipelines, and permissions.
- Methods for interpreting and presenting SonarQube reports to both technical and non-technical stakeholders.
11. Best Practices and Recommendations
- Selecting rule sets and implementing incremental enforcement strategies.
- Workflow recommendations for developers, reviewers, and build pipelines.
- Strategies for scaling SonarQube in enterprise settings.
Conclusion and Future Steps
Requirements
- A solid grasp of the software development lifecycle.
- Practical experience with source control systems and foundational CI/CD principles.
- Proficiency in Java or Angular development environments.
Target Audience
- Developers working with Java, Quarkus, or Angular.
- DevOps and CI/CD engineers.
- Security engineers and application security specialists.
Testimonials (1)
Engaging, and hands on practise.
