Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
1. Foundations of Static Code Analysis and Scope
- Key definitions: static analysis, SAST, rule classifications, and severity levels.
- The role of static analysis in a secure SDLC and its coverage of risks.
- Positioning SonarQube within security controls and developer workflows.
2. SonarQube Overview: Capabilities and Architecture
- Explanation of core services, database structures, and scanner components.
- Best practices for Quality Gates, Quality Profiles, and their management.
- Security features: vulnerability detection, SAST rules, and CWE mapping.
3. Navigating the SonarQube Server Interface
- A guided tour of the Server UI: projects, issues, rules, metrics, and governance views.
- Decoding issue pages, ensuring traceability, and following remediation advice.
- Options for generating and exporting reports.
4. Configuring SonarScanner with Build Tools
- Setting up SonarScanner for Maven, Gradle, Ant, and MSBuild.
- Best practices regarding scanner properties, exclusions, and handling multi-module projects.
- Generating required test data and coverage reports to ensure accurate analysis.
5. Seamless Integration with Azure DevOps
- Establishing SonarQube service connections within Azure DevOps.
- Incorporating SonarQube tasks into Azure Pipelines and enabling PR decoration.
- Importing Azure Repos into SonarQube to automate analysis processes.
6. Project Setup and Third-Party Analyzers
- Configuring project-level Quality Profiles and selecting rules for Java and Angular.
- Utilizing third-party analyzers and understanding the plugin lifecycle.
- Defining analysis parameters and managing parameter inheritance.
7. Roles, Responsibilities, and Secure Methodology Assessment
- Clarifying role separation: developers, reviewers, DevOps staff, and security owners.
- Developing a roles & responsibilities matrix for CI/CD processes.
- Reviewing and optimizing existing secure development methodologies.
8. Advanced Topics: Rule Management, Tuning, and Security Enhancement
- Leveraging the SonarQube Web API to create and manage custom rules.
- Refining Quality Gates and enforcing automated policies.
- Strengthening SonarQube server security and implementing access control best practices.
9. Practical Lab Sessions (Application)
- Lab A: Configure SonarScanner for five Java repositories (using Quarkus where relevant) and analyze the outcomes.
- Lab B: Set up Sonar analysis for an Angular front-end project and interpret the results.
- Lab C: End-to-end pipeline exercise—integrate SonarQube with an Azure DevOps pipeline and activate PR decoration.
10. Testing, Troubleshooting, and Report Analysis
- Techniques for generating test data and measuring coverage.
- Addressing common issues related to scanners, pipelines, and permissions.
- Effectively presenting SonarQube reports to both technical and non-technical stakeholders.
11. Best Practices and Strategic Recommendations
- Selecting rule sets and strategies for incremental enforcement.
- Workflow recommendations for developers, reviewers, and build pipelines.
- Planning for scaling SonarQube in enterprise settings.
Conclusion and Path Forward
Requirements
- A solid grasp of the software development lifecycle.
- Practical experience with source control and fundamental CI/CD principles.
- Proficiency in Java or Angular development environments.
Target Audience
- Software Developers (specifically Java / Quarkus / Angular).
- DevOps and CI/CD Engineers.
- Security Engineers and Application Security Reviewers.
Testimonials (1)
Engaging, and hands on practise.
