> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/new-to-sto/get-started.md).

# Get Started

Get started with Harness STO

This guide helps you get started with Security Testing Orchestration (STO) by walking you through the available security testing capabilities. Learn how to scan code repositories for vulnerabilities and secrets, and follow the code repository onboarding workflow to integrate security testing into your development process.

## What you will learn from this topic

By the end of this topic, you will be able to understand:

* How to onboard code repositories to STO and configure security scans.

## Before you begin

Make a note of the following before you proceed with getting started with STO:

* Understand the STO user journey, core capabilities, and how STO helps identify and manage security issues in your code repositories. For more information, see [STO Overview](https://developer.harness.io/security-testing-orchestration/new-to-sto/overview).
* Learn the key concepts, terminology, and workflows used throughout STO. For more information, see [Key Concepts](https://developer.harness.io/security-testing-orchestration/new-to-sto/key-concepts).

## Set up security scans for code repositories with STO

Harness Security Testing Orchestration (STO) helps you integrate security testing into your development workflow by orchestrating scanners and identifying vulnerabilities in your code before release. By onboarding your code repositories, you can scan for security issues and review findings in STO.

To onboard your code repositories and get started with security scanning in STO, complete the following steps:

1. [Choose the Git repository provider](#step-1-choose-a-git-repository-provider)
2. [Connect the source code management (SCM) account](#step-2-connect-the-scm-account)
3. [Select the repositories](#step-3-select-the-repositories)
4. [Choose and configure the security steps](#step-4-choose-and-configure-the-security-steps)
5. [Select the scan frequency](#step-5-select-the-scan-frequency)
6. [Select the policies to enforce](#step-6-select-the-policies-to-enforce)
7. [Choose the scan infrastructure](#step-7-choose-the-scan-infrastructure)

### Step 1: Choose the Git repository provider

A Git repository hosts your source code and tracks changes made by your development team. STO connects to your Git repository to scan your code for security vulnerabilities and identify potential risks. Complete the following steps to select your Git repository provider and connect your code repository to STO:

1. On the left sidebar, navigate to the **Get Started** page.
2. Select the **Code Repositories** card begin onboarding your code repository.\
   The **Code Repositories** page opens and displays the onboarding steps, starting with choosing your git repository provider.
3. Select one of the following cards to choose your preferred Git repository provider:
   * **GitHub**: Onboard repositories hosted on GitHub.
   * **Bitbucket**: Onboard repositories hosted on Bitbucket.
   * **Harness**: Onboard repositories hosted on Harness Code Repository (HCR).
4. Click **Continue** to proceed to the next step.\
   The **Connect Your SCM Account** step opens and displays the options to connect your Git repository with Harness.

<figure><img src="https://2033425938-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fna57sNwixrWxOX8cOMRg%2Fuploads%2Fh70GFEVYLIh5PMeZGpqW%2Fchoose-repository-provider.png?alt=media&amp;token=2ea98ef5-47ed-4a3d-9655-b4e2e19b0565" alt="Choose the repository provider"><figcaption><p>Choose the repository provider</p></figcaption></figure>

### Step 2: Connect the SCM account

Connect your Git repository to STO using a Harness Connector. Connectors link your Harness account to your preferred SCM provider. You can create a new connector or use an existing connector authorized for your Git provider.

To connect your SCM account, complete the following steps to select or configure a Harness Connector for your Git provider:

1. Select the **Use a Harness Connector** card to open the **Select Connector** sidepanel.<br>

   <figure><img src="https://2033425938-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fna57sNwixrWxOX8cOMRg%2Fuploads%2FpvItWbIrOWYV0il64DZ8%2Fconnect-github-account.png?alt=media&amp;token=111956de-071b-40f4-b678-705f70f18dab" alt="Select the Harness connector"><figcaption><p>Select the Harness connector</p></figcaption></figure>
2. In the **Select Connector** sidepanel, select one of the following cards:
   * **Existing**: Select an existing connector authorized for your Git provider.
   * **New**: Create a new connector for your Git provider. For more information on creating a new connector, go to [Manage Connectors](https://developer.harness.io/harness-platform/3.0/in-harness-3.0/connectors/manage).
3. Select the appropriate tab to view existing connectors available at the **Project**, **Organization**, or **Account** scope in the form of a table.
   * Search for your preferred connector from the list of existing connectors in the search bar.
   * Click the **Filter** button to open the dropdown menu and select the following:
     * **Last modified**: Select this option to sort connectors by the date they were last modified.
     * **Newest**: Select this option to sort connectors from newest to oldest.
     * **Oldest**: Select this option to sort connectors from oldest to newest.
     * **Name (A→Z, 0→9)**: Select this option to sort connectors by name in ascending alphanumeric order.
     * **Name (Z→A, 9→0)**: Select this option to sort connectors by name in descending alphanumeric order.
   * Click the **Pin** button to view the pinned connectors.
4. Select the radio button beside the connector you want to use for onboarding your code repository.
   * Hover over the connector row and click the **Pin** icon to pin the connector for easier access.
   * Click the **Refresh** icon to re-test the connector connection.
   * Click the **Edit** icon to edit the connector configuration.
5. Click **Continue** to proceed to the next step.\
   The **Select Repositories** step opens and displays the available repositories in the form of a table.

<figure><img src="https://2033425938-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fna57sNwixrWxOX8cOMRg%2Fuploads%2FDILsqu6aHNwGzpUO3Jbo%2Fselect-connector.png?alt=media&amp;token=18fcfb40-eb6f-4f00-a095-1b50a86f0e79" alt="Connect the SCM account"><figcaption><p>Connect the SCM account</p></figcaption></figure>

### Step 3: Select the repositories

Select the code repositories you want STO to onboard and scan for security issues. You can select individual repositories or automatically discover and onboard all repositories available through your connected SCM account. You can also enable compliance checks for YAML files.

{% hint style="info" %}
If you select **Harness Code Repository** as your repository provider, STO takes you directly to this step, skipping [Step 2](#step-2-connect-the-scm-account).
{% endhint %}

To select and configure the repositories you want to onboard, complete the following steps:

1. In the **Search repositories** field, enter a repository name to find a specific repository.
2. Select the checkbox beside each repository you want to onboard.
   * To select all repositories displayed on the current page, select the checkbox in the table header.
3. Select the **Automatically discover and onboard all repositories** checkbox to automatically discover and onboard all repositories.
4. Select the **Include compliance check for YAML files** checkbox to include compliance checks for YAML files.\
   This option is enabled by default.
5. Click **Continue** to proceed to the next step.\
   The **Choose Security Steps** opens and displays the available security steps you can enable for your selected repositories.

<figure><img src="https://2033425938-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fna57sNwixrWxOX8cOMRg%2Fuploads%2F8MXuHC8Z9zQvF9YNaLEx%2Fselect-repositories.png?alt=media&amp;token=77a0bf62-c738-4f03-a699-6f0b4cf9b3e9" alt="Select the code repositories"><figcaption><p>Select the code repositories</p></figcaption></figure>

### Step 4: Choose and configure the security steps

Select the security scanners you want to use to scan your code repositories for vulnerabilities and security risks. STO provides scanners across multiple categories, including Software Composition Analysis (SCA), Static Application Security Testing (SAST), Secret Detection, Infrastructure as Code (IaC), and Supply Chain. You can also configure the selected scanners by choosing an existing configuration or creating a new one.

To choose and configure the security scanners for your repositories, complete the following steps:

1. In the **Search Scanners** field, enter a scanner name to find a specific scanner.
2. Select a category to filter the available scanners:
   * **All categories**: View scanners across all available security testing categories.
   * **SCA**: Find scanners that detect vulnerabilities in open-source dependencies and third-party components.
   * **SAST**: Find scanners that analyze source code to identify security vulnerabilities.
   * **Secret Detection**: Find scanners that detect exposed secrets, such as API keys and credentials, in your code.
   * **IaC**: Find scanners that identify security misconfigurations in Infrastructure as Code files.
   * **Supply Chain**: Find scanners that help identify security risks in your software supply chain.
3. Select the checkbox beside each scanner you want to enable for your repositories.
   * Click the **Configure** button on the right of the scanner row to open the **Configure \<Scanner\_Name>** sidepanel.\
     The **Saved Configuration** tab opens by default, displaying existing configurations as cards.
   * Select any existing configuration card.
   * Alternatively, select the **New Configuration** tab to create any new configuration. For more information on creating new configurations, go to [Integrations](https://developer.harness.io/security-testing-orchestration/use-sto/integrations).
   * Click **Confirm** to select any existing configuration or create a new configuration.\
     Once the scanner is configured, a **Configured** label appears beside the scanner name.
4. Review the selected scanners. \
   The selection count at the bottom of the page displays the number of scanners selected.
   * Click the **Edit icon** on the right of the scanner row to select a different configuration.
5. Click **Continue** to proceed to the next step.\
   The **Scan Frequency** step opens and displays the available options for scheduling security scans of your onboarded repositories.

<figure><img src="https://2033425938-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fna57sNwixrWxOX8cOMRg%2Fuploads%2FUPXJYT6HkH135a3bRUfq%2Fchoose-security-steps.png?alt=media&amp;token=9dac049e-fbeb-4802-a5e9-6ea505ff7a6f" alt="Choose the security steps"><figcaption><p>Choose the security steps</p></figcaption></figure>

### Step 5: Select the scan frequency

Choose how frequently STO scans your onboarded code repositories to identify vulnerabilities and security risks.

To configure the scan frequency, complete the following steps:

1. Select one of the following radio buttons to choose how frequently STO scans your onboarded repositories:
   * **Every 12 hours**: Choose this option to run security scans every 12 hours.
   * **Daily**: Choose this option to run security scans once every day.
     * Select the dropdown menu under **Start time** to choose your preferred time to run the security scans.&#x20;
   * **Weekly**: Choose this option to run security scans once every week.
     * Select the dropdown menu under **Day of the week** to choose your preferred day to run the security scans.
     * Select the dropdown menu under **Start time** to choose your preferred time to run the security scans.&#x20;
   * **Custom**: Choose this option to configure a custom schedule for security scans.
     * Select the dropdown menu under **Day of the week** to choose one or more days to run the security scans.
     * Select the dropdown menu under **Start time** to choose your preferred time to run the security scans.
2. Click **Continue** to proceed to the next step.\
   The **Policies to Enforce** step opens and displays the available policies to enforce in the form of cards.

<figure><img src="https://2033425938-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fna57sNwixrWxOX8cOMRg%2Fuploads%2Fjpq3I34nPgQmQijNf0Yx%2Fselect-scan-frequency.png?alt=media&amp;token=579f3773-6482-46bc-a365-9e84b8ed7250" alt="Select the scan frequency"><figcaption><p>Select the scan frequency</p></figcaption></figure>

### Step 6: Select the policies to enforce

Choose how STO should handle security findings detected during scans by configuring the policies to enforce.

To select the policies to enforce, complete the following steps:

1. Enable the toggle on the right of the policy card to enforce that policy.
2. Click **Continue** to proceed to the next step.\
   The **Infrastructure** step opens and displays the options to configure the scan environment.

<figure><img src="https://2033425938-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fna57sNwixrWxOX8cOMRg%2Fuploads%2FnhdQvUOEQ5nQy59sIFTR%2Fenforce-policies.png?alt=media&amp;token=6c5b7b70-0160-4319-b061-fb966da246c3" alt="Enforce the policies"><figcaption><p>Enforce the policies</p></figcaption></figure>

### Step 7: Choose the scan infrastructure

Choose where STO runs security scans for your onboarded code repositories. You can use Harness Cloud for managed infrastructure or a self-hosted runner to run scans on your own infrastructure.

To choose the scan infrastructure, complete the following steps:

1. Select one of the following cards to choose your preferred infrastructure:
   * **Harness Cloud**: Select this option to run scans on Harness-managed infrastructure. This option is selected by default.
   * **Self-hosted Runner**: Select this option to run scans on your own infrastructure and  selecting this option opens the **Self-hosted runner settings** sidepanel.
     * If you select **Self-hosted Runner**, configure the following settings:
       * **Operating system**: Select the operating system for the self-hosted runner. The available options are **Linux**, **Windows**, and **macOS**.
       * **Kubernetes Connector**: Select an existing Kubernetes Connector or create a new one to connect to your Kubernetes cluster. For more information on creating a new connector, go to [Manage Connectors](https://developer.harness.io/harness-platform/3.0/in-harness-3.0/connectors/manage).
       * **Namespace**: Enter the Kubernetes namespace where the self-hosted runner will run.
     * Click **Apply** to save the configuration.<br>

       <figure><img src="https://2033425938-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fna57sNwixrWxOX8cOMRg%2Fuploads%2Fvf0Hk2fitBiyyU78Wccd%2Fselfhosted-runner-settings.png?alt=media&amp;token=0be60d77-a5da-4812-96e9-dafb25d89ef7" alt="Self-hosted runner settings"><figcaption><p>Self-hosted runner settings</p></figcaption></figure>
2. Click **Activate Scanning** to complete the onboarding process and activate security scanning for the selected repositories.

<figure><img src="https://2033425938-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fna57sNwixrWxOX8cOMRg%2Fuploads%2FMhDESgxygTpUZvfl3njR%2Fchoose-scan-infrastructure.png?alt=media&amp;token=5f605241-5dc7-4373-8b31-fda3c5e428ff" alt="Choose the scan infrastructure"><figcaption><p>Choose the scan infrastructure</p></figcaption></figure>

Once the scans for the selected repositories are activated, you will have the following options:

* **Go to code repositories**: To navigate to the code repositories page and view the onboarded repositories. For more information, go to [Code Repositories](https://developer.harness.io/security-testing-orchestration/use-sto/code-repositories).
* **Add another source**: To go back to the **Get Started** page and add another repository source for scanning.
* **Configure security agents**: To navigate to the **Agents** page and enable security agents.
* **View integration**: To navigate to the **Integrations** page and manage the existing integrations. For more information, go to [Integrations](/security-testing-orchestration/use-sto/integrations.md).

### Next steps

* [Code Repositories](https://developer.harness.io/security-testing-orchestration/use-sto/code-repositories): Learn how to explore scanned repositories, investigate security findings, review scan history, and track remediation.
* [Static Application Security Testing - SAST](https://developer.harness.io/security-testing-orchestration/use-sto/set-up-sto-scans/static-application-security-testing): Learn how to configure and run SAST scans to identify potential vulnerabilities in source code.
* [Software Composition Analysis - SCA](https://developer.harness.io/security-testing-orchestration/use-sto/set-up-sto-scans/software-composition-analysis): Learn how to configure and run SCA scans to identify vulnerabilities in open-source dependencies and third-party libraries.