The Portfolio page

• New Project(s): Create a SAST & SCA project, a DAST project, or a Container Analysis project.
• New Project(s) with SCM (only available for customers with concurrent subscriptions): Create multiple SAST & SCA projects using repositories in your SCM.
  Note: See Connect Polaris to Multiple SCM Repositories for more information.

Note: If one or more languages are detected that cannot be scanned (given the test mode), and 90% or more of the code cannot be scanned, a warning icon appears next to the project name, indicating an alternative testing method is required to fully analyze the source. Typically, this occurs when a language in your source files can only be tested from your CI system using Black Duck Bridge.

For each project, view:

• The policy status of the most recent test of each project's default branch
• The project's name and default branch
• The project's type
• The total quantity of tests run
• The total quantity of issues
• Per-severity issue quantities
• The quantity of policy violations captured in the most recent test of each project's default branch
• The latest completed test (including test type) of each project's default branch
• Repository type

Note: Quantities in the Total Active Policy Violations () column may include dismissed issues. See Monitor policy on the Portfolio page for more information on the policy values in this table.

Click a project name or issue quantity to open the Project page (see "Portfolio Project Page" below) and view issues in the Project. When you click an issue quantity in a severity column, only issues matching the severity you select appear on the Project page.

Click on the ellipse icon to select:

• New Test: Test the project (see How to test from the web UI).
• Move project: Move this project to a different application. See Move projects between applications for more information.
• Settings: Open the project's settings.
• Delete: Delete the project.
  Note: All the project's branches and test data will be deleted.

Enable or disable deep license data on an application level.

• Manage an application's file and folder exclusion rules.
• Customize event-based test automation for your application (if part of an onboarded SCM repositories) including types of tests and block merge. See Event-Based Test Automation in Polaris for SCM Integrations for more information.
• Customize SAST Analysis settings for application.
• Customize SCA Analysis settings for application.

• Enable or disable triaging issue severity, unless this feature has been locked by your Organization Administrator. When enabled, users can change severity levels when triaging issues in the application's projects. See Ways to triage issues in Polaris for more information.
• Manage an application's approval workflow—see Set up triage approval workflows for more information.

Each point on the chart represents a test. Hover over a point to view the test's completed date and time, and the quantity of detected or absent issues.

• 30D, 90D, 90D: Show the tests run on the branch in the last 30 (default), 60, or 90 days.
• Since First Test: Show all the tests run on the branch.
• Custom Range: Show the tests run on the branch between two dates.

Hover over a bar in the chart to see the value in days.

• Container (Container Analysis projects only)
• Pending Approvals (find triage requests that need approval)
• Triage Status
• Fix-By Status
• Issue Type
• Issue Category
• Risk Score
• Severity
• Severity Modified
• Tool Type — DAST, SAST (All, Full, or Rapid), and/or SCA (All, Package Manager, Signature Analysis, Binary Analysis, or Container Analysis)
• Location
• CWE (Common Weakness Enumeration, CWE™)
• Standard
• Owner (assignee)
• Pull/Merge Request Policy
• Policy Violations
• Exposure (Reachable and/or Undetermined)

• A description of the issue and its severity
• Local effect
• Links to related CWE and Common Vulnerabilities and Exposures (CVE®) codes (when available)
• CISA KEV status (when the issue appears on the CISA Known Exploited Vulnerabilities catalog)
  Note: A red CISA KEV label appears in the Issue Type column, next to SCA issues on the CISA KEV list.
• Black Duck® Security Advisory (BDSA) codes (when available)
• A link to training resources in Secure Code Warrior (when available, and after the Secure Code Warrior integration is enabled by your Organization Administrator)
• A list of branches the issue is found in
• The Tool and Tool Type that detected the issue
• And more

When you select a SAST issue, you can:

• Generate remediation guidance with Black Duck Assist.
  Note: See Generate SAST remediation guidance with Black Duck Assist for more information.
• Use the Contributing Code Events tab which lets you drill down into the code and see the file path.

For SCA issues, you can use the Exposure tab to see Reachable and/or Undetermined component vulnerabilities (if reachability analysis is enabled).

For issues captured in DAST tests, you can use the Evidence tab to find more information on attacks.

Hover over the policy status icon to view the names of issue policies an issue violates.

Hover over the policy status icon to view the names of component policies a component violates.

Each component captured in an SCA test is compared with a copy of the component in the Black Duck KnowledgeBase™ to generate additional metadata. Precise match types (beyond direct and transitive dependencies) and (percentage) match scores are generated for components captured in signature analysis tests.

Each component can have multiple match type values. Match types include:

• Direct Dependency: A direct dependency is a package your project requires to run and compile (typically, managed with package managers like pip, npm, ... etc.). It is possible for a package to be both a direct and transitive dependency.
• Transitive Dependency: Transitive dependencies are packages that aren't directly referenced in your project, but rather, are packages that are referenced by your project's direct dependencies. It is possible for a package to be both a direct and transitive dependency.
• Exact Directory: The component's directory structure matches the directory structure in the KnowledgeBase.
• Exact File: The component's files match files in the KnowledgeBase.
• Files Added/Deleted: The component includes additional files, or doesn't include some of the files in the KnowledgeBase.
• Files Modified: One or more of the component's files were modified and don't match files in the KnowledgeBase.
• Manually Added: The component was added to the project manually.
• Manually Edited: The component was captured in a test, and then modified manually.

A higher match score indicates a closer match, and a lower match score indicates a component was modified. Precise match scores only appear for components identified in signature analysis tests; the match score for a component identified in a package manager test will always be 100%.

Select a component's name to view:

• Component Details
  • View detailed information about the component including Match Types, Match Score, a description of the component, and helpful links.
  • View Component Origins (different ways the component is included in the project). For each component origin, view upgrade guidance and a dependency tree (View Dependency Tree).
  • For components captured in a Container Analysis project, view Container Layers to see the layers in which the component was introduced and, if applicable, modified.
  • View Upgrade Guidance and Create Fix Pull Request (if applicable).
• Security Details
  • A list of issues that match the component version, a link to issue details, triage status, origin, CWE and vulnerability ID.
    Note: A red CISA KEV label appears in the Issue Type column, next to SCA issues on the CISA KEV list.
• Licenses
  • List of licenses available for this component version.
  • License information.
  • License terms with definitions and categories.
  • If available, you can select a different license depending on use case.
• Copyrights
  • View copyright text and component origins for the selected component.
  • View security risk.

• License Name: The full name of the license. Click on name for screen that includes the following tabs:
  • License Details - View license family and other details. Licenses cannot be edited here. See Edit and review licenses.
  • Terms - List of Required, Forbidden and Permitted terms.
  • Usage - List of components used by license.
  • History - Changes and license text.
• License Family: Permissive, Reciprocal, Weak Reciprocal, Reciprocal Network, Restricted Proprietary or Unknown.
• Component Count: Number of components using this license.
• Source: Modified or Knowledge Base
• Status: Review status:
  • Unreviewed
  • In Review
  • Reviewed
  • Approved
  • Limited Approval
  • Rejected
  • Deprecated
  See Edit and review licenses for more information.
• Last Updated: When modified last.
• Expiration Date: Can be updated when editing license. Informational only.

• Name: The name of each container in the project.
• Description: A brief description of the container.

After you open a SAST & SCA project, use the SAST, SCA, and External Analysis tabs to the left of the table to view different types of tests. The DAST tab opens for DAST projects. Container Analysis projects show tests run against each container in the project.

• Test ID: An ID that uniquely identifies the test. Hover over a completed SAST test ID to see the programming languages detected in the test, displayed as approximate percentages (for example, JavaScript 74.33%, HTML 24.2%, Makefile 1.47%).
  Note: If one or more languages are detected that cannot be scanned (given the test mode), and 90% or more of the code cannot be scanned, a warning icon appears, indicating an alternative testing method is required to fully analyze the source. Typically, this occurs when a language in your source files can only be tested from your CI system using Black Duck Bridge.
• Date: The date and time when the test started.
• Test Status: The status of the test (Completed, Canceled, etc.).
• Policy Violations: Shows the quantity of policy violations detected in the test, and the quantity of issue and component policies assigned to the project (or branch) when the test started. Select the info icon to see the names of the issue and component policies, along with links to view issues that violate different rules.
  Note: Policy information only appears next to completed tests if issue/component policies were assigned to the branch (for SAST & SCA projects) or DAST project when the test started. Component policies only appear for SCA tests. See Monitor policy on the Tests page for more information.

  When you create non-default branches, policies are disabled by default. You can enable policies on non-default branches when you Add a branch to a project or Edit a branch (manually created).

Select a test ID to see:

• Detected Issues: Issues detected in the test.
• Absent Issues: Issues found in the previous test, but not found in the current test.
• Test Metrics: A comparative summary of the current and previous test that includes the programming languages found in the tests (SAST tests only), the number of files captured and analyzed, lines of code analyzed, and analysis time.
  Note: A warning icon appears next to Test Metrics when one or more languages are detected that cannot be scanned (given the test mode), and 90% or more of the code cannot be scanned. Typically, this occurs when a language in your source files can only be tested from your CI system using Black Duck Bridge.
• Debugging: Download a test's artifacts (if available) and retrieve its UID.

Lists all the branches in the SAST & SCA project. Here, you can see:

• The project's default branch
• The date and time of the most recent test run against the branch

Click a branch name to modify the branch's settings, including:

• Branch Name
• Branch Description
• How often the branch needs to be tested before it's deleted automatically
• Customizable SAST Analysis settings for branch
• Customizable SCA Analysis settings for branch
• Policy settings, including:
  • If the branch's policies are set manually, or inherited from the project
  • The branch's issue policies
  • The branch's component policies
  • The branch's test scheduling policies
• Test Automation - Modify or reset events that will initiate scan (if available). See Event-Based Test Automation in Polaris for SCM Integrations.
• View Fix Pull Request settings and customize for branch.

Lists the profiles in the DAST project.

Here, you can see:

• The date and time of the most recent test run against the project
• The quantity of issues captured in the most recent test, grouped by severity

Select a profile name to modify its settings, including:

• Profile Name
• Allowed Hosts and Authentication
• The profile's scan-settings.json file
• Whether or not active attacks are performed when the project is tested

• Set up a Source Code Management (SCM) repository integration. See Connect a Polaris project to a repository in your SCM.
• Select a globally-configured issue tracking integration for the project. See Issue tracking integrations for more information.
• View and customize Fix Pull Request settings for the project.

Enable or disable deep license data on a project level.

• Manage a project's file and folder exclusion rules.
• Customize event-based test automation for your project (if part of an onboarded SCM repositories). See Event-Based Test Automation in Polaris for SCM Integrations for more information.
• Customize SAST Analysis settings for project.
• Customize SCA Analysis settings for project.