Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
1. Fundamentals and Scope of Static Code Analysis
- Key definitions: static analysis, SAST, rule classifications, and severity levels
- The role of static analysis in secure SDLC and its risk coverage
- How SonarQube aligns with security controls and developer workflows
2. SonarQube Overview: Capabilities and Architecture
- Essential components: core services, database, and scanners
- Best practices for Quality Gates, Quality Profiles, and gate management
- Security features: vulnerability detection, SAST rules, and CWE mapping
3. Navigating and Utilizing the SonarQube Server Interface
- Server UI walkthrough: projects, issues, rules, metrics, and governance views
- Analyzing issue pages, traceability paths, and remediation guidance
- Generating and exporting reports
4. Configuring SonarScanner with Build Tools
- Setting up SonarScanner for Maven, Gradle, Ant, and MSBuild
- Best practices for scanner properties, file exclusions, and multi-module projects
- Generating test data and coverage reports to ensure analysis accuracy
5. Integration with Azure DevOps
- Establishing SonarQube service connections within Azure DevOps
- Incorporating SonarQube tasks into Azure Pipelines and enhancing Pull Requests
- Importing Azure Repos into SonarQube and automating analysis cycles
6. Project Setup and Third-Party Analyzers
- Configuring project-level Quality Profiles and selecting rules for Java and Angular
- Managing third-party analyzers and the plugin lifecycle
- Defining analysis parameters and managing parameter inheritance
7. Roles, Responsibilities, and Secure Development Methodology Assessment
- Role separation: developers, reviewers, DevOps, and security owners
- Developing a roles and responsibilities matrix for CI/CD processes
- Evaluating and recommending improvements to existing secure development methodologies
8. Advanced Topics: Rule Management, Tuning, and Global Security Enhancements
- Leveraging the SonarQube Web API to create and manage custom rules
- Refining Quality Gates and enforcing automated policies
- Strengthening SonarQube server security and access control best practices
9. Practical Lab Sessions (Application)
- Lab A: Configure SonarScanner for five Java repositories (including Quarkus where relevant) and analyze outcomes
- Lab B: Set up Sonar analysis for an Angular front-end and interpret the findings
- Lab C: Comprehensive pipeline exercise—integrate SonarQube with an Azure DevOps pipeline and enable Pull Request decoration
10. Testing, Troubleshooting, and Report Analysis
- Strategies for generating test data and measuring coverage
- Resolving common scanner, pipeline, and permission-related errors
- Interpreting and presenting SonarQube reports to both technical and non-technical stakeholders
11. Best Practices and Strategic Recommendations
- Selecting rule sets and implementing incremental enforcement strategies
- Workflow suggestions for developers, reviewers, and build pipelines
- Scaling SonarQube in enterprise environments: a roadmap approach
Summary and Recommended Next Steps
Requirements
- A solid grasp of the Software Development Lifecycle (SDLC)
- Practical experience with source control and fundamental CI/CD concepts
- Proficiency in Java or Angular development environments
Target Audience
- Developers working with Java, Quarkus, or Angular
- DevOps and CI/CD Engineers
- Security Engineers and Application Security Reviewers
Testimonials (1)
Engaging, and hands on practise.
