Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
1. Foundations and Scope of Static Code Analysis
- Core definitions: static analysis, SAST, rule categorization, and severity levels
- The role of static analysis in a secure SDLC and its impact on risk coverage
- Positioning SonarQube within security controls and developer workflows
2. SonarQube Overview: Capabilities and Architecture
- Key components: core services, database, and scanner modules
- Best practices for Quality Gates, Quality Profiles, and governance
- Security-focused features: vulnerability detection, SAST rules, and CWE mapping
3. Navigating and Utilizing the SonarQube Server UI
- Comprehensive UI tour: projects, issues, rules, metrics, and governance views
- Analyzing issue pages, traceability, and remediation guidance
- Generating and exporting reports
4. Configuring SonarScanner with Build Tools
- Setting up SonarScanner for Maven, Gradle, Ant, and MSBuild
- Best practices for scanner properties, exclusions, and multi-module projects
- Generating required test data and coverage reports for accurate analysis
5. Integration with Azure DevOps
- Establishing SonarQube service connections within Azure DevOps
- Incorporating SonarQube tasks into Azure Pipelines and implementing PR decoration
- Importing Azure Repos into SonarQube to automate analyses
6. Project Configuration and Third-Party Analyzers
- Defining project-level Quality Profiles and selecting rules for Java and Angular
- Managing third-party analyzers and the plugin lifecycle
- Configuring analysis parameters and managing parameter inheritance
7. Roles, Responsibilities, and Secure Development Methodology Review
- Defining role segregation: developers, reviewers, DevOps, and security owners
- Developing a roles and responsibilities matrix for CI/CD processes
- Evaluating and refining existing secure development methodologies
8. Advanced Topics: Adding Rules, Tuning, and Enhancing Global Security
- Leveraging the SonarQube Web API to create and manage custom rules
- Refining Quality Gates and enforcing automated policies
- Strengthening SonarQube server security and access control practices
9. Applied Hands-on Lab Sessions
- Lab A: Configure SonarScanner for five Java repositories (including Quarkus where relevant) and analyze results
- Lab B: Set up Sonar analysis for one Angular front-end application and interpret findings
- Lab C: Comprehensive pipeline lab—integrate SonarQube with an Azure DevOps pipeline and activate PR decoration
10. Testing, Troubleshooting, and Report Analysis
- Strategies for generating test data and measuring coverage
- Resolving common scanner, pipeline, and permission errors
- Parsing and presenting SonarQube reports to both technical and non-technical stakeholders
11. Best Practices and Strategic Recommendations
- Selecting rule sets and implementing incremental enforcement strategies
- Workflow recommendations for developers, reviewers, and build pipelines
- Scalability roadmap for SonarQube in enterprise settings
Summary and Next Steps
Requirements
- A foundational understanding of the software development lifecycle
- Practical experience with source control and basic CI/CD concepts
- Familiarity with Java or Angular development environments
Target Audience
- Developers (Java / Quarkus / Angular)
- DevOps and CI/CD engineers
- Security engineers and application security reviewers
Testimonials (1)
Engaging, and hands on practise.
