Klocwork is a Static Application Security Testing (SAST) solution that helps organizations identify security vulnerabilities and quality issues in source code through deep static analysis.
Add a Klocwork scan to your workflows in CloudBees Unify to:
-
Detect security vulnerabilities and quality defects in source code.
-
Identify potential security flaws early in the development lifecycle.
-
Gain insight into code quality risks and how to fix issues.
-
Ensure compliance with industry standards such as OWASP, CWE, CERT, and MISRA.
CloudBees Unify enables you to run a Klocwork scan either implicitly or explicitly.
Explicit and implicit scan types
An implicit scan is automatically triggered, and an explicit scan is one you configure to be invoked in a step of your workflow. To learn more about the differences between explicit and implicit scans, refer to Understanding security center workflows.
To set up implicit scanning, refer to Configure implicit security analysis.
How the scanner works
The Klocwork SAST scanner architectural components are:
-
Client-side: The Klocwork analysis engine and command-line tools (
kwbuildproject,kwciagent). -
Server-side: The Klocwork Server for centralized analysis results management.
-
Analysis engine: Proprietary static analysis engine with deep dataflow and control flow analysis capabilities.
The scanning process is as follows:
-
The Klocwork build specification is created to capture the build configuration of your project.
-
Source code is analyzed on the client side using the Klocwork analysis engine.
-
The analysis results are uploaded to the Klocwork Server (if configured).
-
Security vulnerabilities and quality defects are identified based on enabled checkers and taxonomies.
-
Results are reported with severity levels, detailed descriptions, and remediation guidance.
-
The scan results are made available as actionable outputs for quality gates and downstream workflow steps.
| For more information about the Perforce Klocwork SAST scanner, refer to the Perforce Klocwork documentation. |