Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
1. Static Code Analysis: Concepts and Scope
- Key definitions: static analysis, SAST, rule categories, and severity levels
- The role of static analysis in secure SDLC and risk coverage
- How SonarQube aligns with security controls and developer workflows
2. SonarQube Overview: Features and Architecture
- Core services, database, and scanner components
- Best practices for Quality Gates, Quality Profiles, and related standards
- Security-focused features: vulnerabilities, SAST rules, and CWE mapping
3. Navigating the SonarQube Server UI
- Guided tour of the Server UI: projects, issues, rules, measures, and governance views
- Understanding issue pages, traceability, and remediation advice
- Options for generating and exporting reports
4. Configuring SonarScanner with Build Tools
- Setting up SonarScanner for Maven, Gradle, Ant, and MSBuild
- Best practices for scanner properties, exclusions, and multi-module projects
- Generating essential test data and coverage reports for precise analysis
5. Azure DevOps Integration
- Establishing SonarQube service connections within Azure DevOps
- Incorporating SonarQube tasks into Azure Pipelines and enhancing pull requests
- Importing Azure Repos into SonarQube and automating analysis workflows
6. Project Configuration and Third-Party Analyzers
- Defining project-level Quality Profiles and selecting rules for Java and Angular
- Utilizing third-party analyzers and managing the plugin lifecycle
- Specifying analysis parameters and parameter inheritance
7. Roles, Responsibilities, and Secure Development Methodology Review
- Role segregation: developers, reviewers, DevOps, and security owners
- Creating a roles and responsibilities matrix for CI/CD processes
- Evaluating and recommending improvements to existing secure development methodologies
8. Advanced: Adding Rules, Tuning, and Enhancing Global Security Features
- Using the SonarQube Web API to create and manage custom rules
- Refining Quality Gates and enforcing automated policies
- Strengthening SonarQube server security and implementing access control best practices
9. Hands-on Lab Sessions (Practical Application)
- Lab A: Configure SonarScanner for five Java repositories (Quarkus where applicable) and review results
- Lab B: Set up Sonar analysis for one Angular front-end project and interpret findings
- Lab C: Comprehensive pipeline lab—integrate SonarQube with an Azure DevOps pipeline and enable pull request decoration
10. Testing, Troubleshooting, and Report Interpretation
- Techniques for generating test data and measuring coverage
- Addressing common issues: troubleshooting scanner, pipeline, and permission errors
- Interpreting and presenting SonarQube reports to both technical and non-technical stakeholders
11. Best Practices and Recommendations
- Strategies for rule set selection and incremental enforcement
- Workflow recommendations for developers, reviewers, and build pipelines
- Planning the roadmap for scaling SonarQube in enterprise environments
Summary and Next Steps
Requirements
- A solid grasp of the software development lifecycle
- Practical experience with source control and fundamental CI/CD concepts
- Knowledge of Java or Angular development environments
Target Audience
- Developers (Java / Quarkus / Angular)
- DevOps and CI/CD engineers
- Security engineers and application security reviewers
Testimonials (1)
Engaging, and hands on practise.
