Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
1. Principles and Scope of Static Code Analysis
- Key definitions: static analysis, SAST, rule classifications, and severity levels
- The role of static analysis in securing the SDLC and covering risk areas
- Positioning SonarQube within security controls and developer workflows
2. SonarQube Overview: Capabilities and Architecture
- Core components: services, database, and scanners
- Best practices for Quality Gates, Quality Profiles, and governance
- Security-focused features: vulnerability detection, SAST rules, and CWE mapping
3. Navigating the SonarQube Server Interface
- A comprehensive tour of the Server UI: projects, issues, rules, metrics, and governance views
- Analyzing issue pages, tracking traceability, and following remediation guidance
- Generating and exporting reports
4. Configuring SonarScanner with Build Tools
- Installation and setup of SonarScanner for Maven, Gradle, Ant, and MSBuild
- Best practices for managing scanner properties, exclusions, and multi-module projects
- Generating required test data and coverage reports to ensure analysis accuracy
5. Integration with Azure DevOps
- Establishing SonarQube service connections within Azure DevOps
- Embedding SonarQube tasks into Azure Pipelines and enabling pull request decoration
- Importing Azure Repos into SonarQube and automating the analysis process
6. Project Configuration and Third-Party Analyzers
- Tailoring project-level Quality Profiles and selecting rules for Java and Angular
- Managing third-party analyzers and understanding the plugin lifecycle
- Setting analysis parameters and understanding parameter inheritance
7. Roles, Responsibilities, and Secure Development Methodology Assessment
- Defining role segregation: developers, reviewers, DevOps, and security owners
- Developing a roles and responsibilities matrix for CI/CD processes
- Evaluating and recommending improvements to existing secure development methodologies
8. Advanced Topics: Custom Rules, Tuning, and Global Security Enhancements
- Leveraging the SonarQube Web API to create and manage custom rules
- Refining Quality Gates and implementing automated policy enforcement
- Hardening SonarQube server security and implementing access control best practices
9. Applied Hands-on Lab Sessions
- Lab A: Setting up SonarScanner for five Java repositories (incorporating Quarkus where relevant) and analyzing outcomes
- Lab B: Configuring Sonar analysis for an Angular front-end application and interpreting results
- Lab C: Comprehensive pipeline lab—integrating SonarQube with an Azure DevOps pipeline and activating PR decoration
10. Testing, Troubleshooting, and Interpreting Reports
- Strategies for generating test data and measuring coverage
- Diagnosing and resolving common scanner, pipeline, and permission errors
- Presentation techniques for SonarQube reports tailored to both technical and non-technical stakeholders
11. Best Practices and Strategic Recommendations
- Selecting rule sets and strategies for incremental enforcement
- Workflow recommendations for developers, code reviewers, and build pipelines
- A roadmap for scaling SonarQube across enterprise environments
Summary and Future Steps
Requirements
- A solid grasp of the software development lifecycle (SDLC)
- Proficiency with source control systems and fundamental CI/CD concepts
- Working knowledge of Java or Angular development environments
Target Audience
- Developers specializing in Java, Quarkus, or Angular
- DevOps and CI/CD engineers
- Security engineers and application security reviewers
Testimonials (1)
Engaging, and hands on practise.
