Search code examples
securityfortify

Running fortify scan without losing previous analysis


I want to merge different versions of Scan result. Real world scenario: I have an application and ran the scan, performed analysis , fixed the issues now i need to run the scan again. Will the generated output overwrite my previous analysis or will it merge it.


Solution

  • SCA by default merges your results with the previous scan. After the second scan, you will be able to filter on "new" issues that appeared in the second scan; or "removed" issues which have disappeared. The "removed" issues are hidden by default in the user interface. The issues that exist in both scans are called "updated" by the user interface.

    Use "View"->"Removed Issues" to enable the removed issues.

    Use "Group by"->"New Issue" to group the issues by new/updated/removed.

    If you have any doubts about SCA's fidelity when running this merge, you could of course just make a safety backup of your original FPR first.