Skip to main content

Onboarding Applications Best Practices

How you onboard applications will depend on a rough idea of your total inventory of applications.

No. of Apps

Method

Details

< 50

Manually onboard

  • Creating an application

  • Scanning with the user interface

< 500

Automatic Application Creation

  • Enable automatic application creation

  • Adding to ci build

  • Command line scanner (CLI)

> 500

Onboarding Scripts (REST API)

  • IQ Server REST API

any

Easy SCM Onboarding

any

Config-as-Code project

Manually Onboard

Add applications using the Organizations and Applications menu of the IQ Server user interface (UI).

  • Recommended for a limited (<50) number of applications

  • Great for testing and pilot teams

  • Not an effective long-term strategy

  • Common for third-party software and legacy code

  • Application ids and names will need to be unique

  • Consider using an onboarding script if you already have a complete list

Potential Pitfalls:

  • Manually adding applications can be slow.

  • Does not scale.

  • Easy to make mistakes:

    • Avoid duplicating application ids when using a build configuration template

    • Noisy notifications and faulty metrics

    • May break remediation waivers

Automatic Application Creation

Configure the IQ server to allow applications to automatically be added when using an unused PublicID during a scan.

  • Applications are automatically added to a default organization.

    • The default organization may be configured in the UI.

  • Recommended for applications that would need to be onboarded over time.

  • Application Categories will need to be manually set.

Recommendations:

  • Assign someone to review in a holding organization

    • assign Application Categories

    • move to the correct organization

    • rename the applications to something more human-recognizable

  • Not recommended for confidential applications.

Pitfalls:

  • Very easy to create new applications unintentionally

  • Currently cannot track the scan back to the source

  • Only a single default organization

  • The scan may not have the correct policy

  • Access controls may not be set correctly

  • Notifications may be sent to the wrong people

Resources:

Onboarding through Source Control Managers

Easy SCM Onboarding lets you select applications to onboard through a point-and-click menu in the UI.

  • Scans are run against the source code.

  • Scanners will look for dependency lock files as well as binaries.

  • Look for common language-specific patterns.

  • Review the analysis documentation for details.

Pitfalls:

  • Manifest scanning does not provide a complete risk analysis of your built application.

  • A complete scan will still need to be added during the build process.

Onboarding Scripts (REST API)

Using the REST API to configure applications preemptively or in real-time.

  • Directly integrate into your application management systems

  • Recommended for a large number of applications or self-service growth

  • Match to your internal systems using ids, application names, and existing groups

Pitfalls:

  • DO NOT test onboarding scripts in production; start with a backup.

  • Major deployments are challenging to roll back or correct.

  • Fully test scripts in a development environment before production.

  • Monitor systems for irregularities and stability.

Resources: