Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
1. Principles and Scope of Static Code Analysis
- Definitions: static analysis, SAST, rule categories, and severity levels
- Role of static analysis in secure SDLC and risk mitigation
- Integration of SonarQube into security controls and developer workflows
2. SonarQube Introduction: Capabilities and Architecture
- Core services, database, and scanner components
- Best practices for Quality Gates, Quality Profiles, and Quality Gates
- Security features: vulnerability detection, SAST rules, and CWE mapping
3. Navigating the SonarQube Server Interface
- Overview of the Server UI: projects, issues, rules, metrics, and governance views
- Analyzing issue pages, traceability, and remediation advice
- Generating and exporting reports
4. Configuring SonarScanner with Build Tools
- Installation and setup of SonarScanner for Maven, Gradle, Ant, and MSBuild
- Best practices for scanner properties, exclusions, and multi-module projects
- Creating essential test data and coverage reports for precise analysis
5. Azure DevOps Integration
- Establishing SonarQube service connections within Azure DevOps
- Incorporating SonarQube tasks into Azure Pipelines and Pull Request (PR) decoration
- Importing Azure Repos into SonarQube and automating analysis processes
6. Project Setup and Third-Party Analyzers
- Configuring project-level Quality Profiles and selecting rules for Java and Angular
- Managing third-party analyzers and plugin lifecycles
- Setting analysis parameters and managing parameter inheritance
7. Roles, Responsibilities, and Secure Development Methodology Assessment
- Role separation: developers, reviewers, DevOps, and security leads
- Developing a roles and responsibilities matrix for CI/CD processes
- Evaluating and suggesting improvements to existing secure development methodologies
8. Advanced: Rule Management, Tuning, and Global Security Enhancements
- Leveraging the SonarQube Web API to create and manage custom rules
- Modifying Quality Gates and enforcing automated policies
- Strengthening SonarQube server security and access control protocols
9. Practical Lab Sessions (Applied)
- Lab A: Configure SonarScanner for five Java repositories (using Quarkus where applicable) and review results
- Lab B: Set up Sonar analysis for one Angular front-end and interpret the findings
- Lab C: End-to-end pipeline lab—connect SonarQube with an Azure DevOps pipeline and activate PR decoration
10. Testing, Troubleshooting, and Report Analysis
- Methods for generating test data and measuring coverage
- Resolving common issues related to scanner, pipeline, and permission errors
- Interpreting and presenting SonarQube reports to both technical and non-technical stakeholders
11. Best Practices and Strategic Recommendations
- Selecting rule sets and implementing incremental enforcement strategies
- Workflow suggestions for developers, reviewers, and build pipelines
- Planning the expansion of SonarQube in enterprise settings
Summary and Future Steps
Requirements
- A solid grasp of the software development lifecycle
- Proficiency with source control and fundamental CI/CD concepts
- Knowledge of Java or Angular development environments
Audience
- Developers (Java / Quarkus / Angular)
- DevOps and CI/CD engineers
- Security engineers and application security reviewers
Testimonials (1)
Engaging, and hands on practise.
