Software Requirements

The Fortify Jenkins Plugin works with the software packages listed in the following table. Your specific requirements depend on the build tools you are using. This table also provides information to help you prepare to add Fortify Static Code AnalyzerA set of software security analyzers that scan source code for violations of security-specific coding rules and guidelines for a variety of languages. The rich data provided by the language technology enables the analyzers to pinpoint and prioritize violations so that fixes can be fast and accurate. analysis to your jobs.

Software	Version	Notes
Micro Focus Fortify Static Code Analyzer	18.20 or later	To scan your project locally with Fortify Static Code Analyzer, you must either have the path to the Fortify Static Code Analyzer installation directory so you can specify it in the configuration or make sure that the PATH environment variableBuilding blocks for performance indicators; storage for measurement values that count issues, conditions, and similar categories of numeric data. includes the sourceanalyzer executable (see Configuring Global Settings for the Fortify Jenkins Plugin). Note: Performing remote analysis requires Fortify Static Code Analyzer version 19.2.0 or later.
Micro Focus Fortify Software Security CenterA centralized system that helps application developers find, fix, and verify security vulnerabilities, to comply with application security standards and to meet audit, regulatory, customer, and partner requirements. Fortify Software Security Center combines results from Fortify Static Code Analyzer, Fortify WebInspect Enterprise, and other industry analyzers. (Optional)	18.20 or later	To upload scan results to Fortify Software Security Center, to trigger a build failure based on scan results, and to see results in Jenkins, make sure that you have: The Fortify Software Security Center URL A Fortify Software Security Center authentication tokenUnique keys that enable users to automate actions within Fortify Software Security Center without using passwords. The user requests a token, authenticates to the Fortify Software Security Center server, and receives back a string that is permissioned for a small set of time-limited actions. Fortify Scan Analytics also generates authentication tokens that are required to configure a connection between Scan Analytics and Fortify Software Security Center. of type CIToken (see Preparing Fortify Software Security Center to Work with the Fortify Jenkins Plugin) To perform a remote analysis, make sure that you have: A Fortify Software Security Center authenticationIdentity verification, typically with passwords. Authentication precedes authorization. of type ScanCentralCtrlToken (see Preparing Fortify Software Security Center to Work with the Fortify Jenkins Plugin) Note: The ScanCentralCtrlToken was introduced in Fortify Software Security Center version 20.1.0. Use the CloudCtrlToken with Fortify Software Security Center versions 19.2.x and earlier.
Micro Focus Fortify ScanCentralFortify ScanCentral is a set of components (the Controller, clients, and sensors) that enable users to better manage their resources by offloading the processor-intensive scanning phase of code analysis from their build machines to a cloud of machines provided for this purpose. (Optional)	19.2.0 or later	To perform a Fortify Static Code Analyzer analysis on a remote system using Fortify ScanCentral, make sure that you have properly configured Fortify ScanCentral and you have the ScanCentral ControllerServer that receives a Fortify Static Code Analyzer mobile build session (MBS) and scan instructions from ScanCentral clients and routes the information to the ScanCentral sensors. URL. Note: If you plan to upload remote scan results to Fortify Software Security Center, then you do not need to provide a ScanCentral Controller URL. The Fortify Jenkins Plugin automatically determines the ScanCentral Controller that is associated with Fortify Software Security Center. Fortify ScanCentral supports offloading project translation for .NET applications in C# and VB.NET (.NET Core, .NET Standard, C#, ASP.NET), ABAP, Apex, Classic ASP, ColdFusion, Java (including Gradle and Maven projects), JavaScript, PHP, PL/SQL, Python, Ruby, T-SQL, TypeScript, and Visual Basic. Note: Translation of .NET requires the following: Fortify ScanCentral version 19.2.0 requires .NET Framework 4.6.1 or later. Fortify ScanCentral version 20.1.0 or later requires .NET Framework version 4.7.2 or later.
Maven	3.x	To integrate the scan with Maven, you must install the Fortify Maven plugin, which is available when you install Fortify SCA and Apps. Fortify recommends that you use the same Fortify Maven Plugin version as the Fortify Static Code Analyzer version and that you install the source version of the Fortify Maven Plugin rather than the binary version. You must install the Fortify Maven Plugin for the same user who is running Jenkins. If you use a proxy, then you need to configure proxy settings for the Fortify Maven Plugin. For information, see the Settings Reference at https://maven.apache.org. For more information about build integrationAbility to translate your codebase as part of your build process. with the Fortify Maven Plugin, see the Micro Focus Fortify Static Code Analyzer User Guide.
MSBuild	4.x, 12.0, 14.0, 15.x, 16.4	Fortify Static Code Analyzer version 20.1.0 and later support MSBuild 16.4.
Visual Studio (devenv)	2015, 2017, 2019	Fortify Static Code Analyzer version 20.1.0 and later support Visual Studio 2019.