Nexus IQ step configuration

Scan code repositories with Nexus.

You can use the Nexus IQ Scanner in Harness STO to scan your Code Repositories for Software Composition Analysis (SCA). This document guides you through the configuration process, explaining each field and the information required to set up the scan step successfully.

• You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer Configure your pipeline to use STO images from private registry.

• STO supports three different approaches for loading self-signed certificates. For more information, refer Run STO scans with custom SSL certificates.

Nexus IQ step settings

The recommended workflow is to add the step to a Security or Build stage and then configure it as described below.

Scan

Scan Mode

• Orchestration mode: In this mode, the step executes the scan, then processes the results by normalizing and deduplicating them.

• Ingestion mode: In this mode, the step reads scan results from a data file, normalizes the data, and removes duplicates. It supports ingestion of results from scan results in SARIF format.

• Extraction mode: In this mode, the step retrieves scan results from the Nexus IQ server/portal and stores them in STO

Scan Configuration

Target

Type

Target and variant detection

Name

Variant

Workspace

Ingestion File

Authentication

Domain

Access ID

Access Token

Scan Tool

Lookup Type

Select how to identify the application in Extraction scan mode. You can specify the application by its Public ID or Private ID.

Project Name

The name of the scan project as defined in your scanner configuration. In Harness, this value is also used as the Target Name when the Auto option is selected under Target and Variant Detection.

Organization ID

The unique identifier of your organization in Nexus IQ Server. This ID is used to associate policies, applications, and scan results with the correct organizational context in Nexus IQ. If the application doesn't exist and automatic creation is enabled, it will be created under this organization.

You can find the Organization ID in the URL of your Nexus IQ Server/Portal, e.g., for https://your-nexus-server/#/management/view/organization/44a7583387054c2fb55aefeb7c618195 the Organization ID is 44a7583387054c2fb55aefeb7c618195.

Lookup ID

The identifier for the specific application you are scanning in Nexus IQ, also known as the Application ID. This maps scan results to a known application profile in your Nexus IQ Server. When automatic creation is enabled and this ID hasn't been used before, a new application is created with this ID.

• The Public ID is typically what you use for application lookups and can be found under the App Name in Nexus IQ UI.

• The Private ID is an internal reference, mainly used in API calls or advanced scenarios.

Exclude

Define the exclusions to the scan's initial scope. The format should follow the Nexus IQ scanner requirements. You can exclude both files and folders, separated by commas. For example: exclude="cmd,*/go.mod"

Log Level

Additional CLI flags

Use this field to run the Nexus with flags.

Fail on Severity

Additional Configuration

Advanced settings

Proxy settings