How to configure Azure DevOps with DigitSec
Please follow these steps to set up S4 to scan your Azure DevOps repository based on Azure DevOps events.
- First, you will need to retrieve an Azure Web Secret specific to your Workspace. Please use a browser to go to https://s4.digitsec.com and sign in.
- After logging in, find the Workspace you wish to integrate. Click on the Workspace Title and then choose the INTEGRATION tab and the Azure sub-tab.
- The Azure Secret should be obscured in the first input box. Please use the clipboard icon to copy the field contents. You will need to use this key in Step 10.
- Open a new browser window and login into your Azure DevOps repository.
- In the lower left corner, please click on Project Settings
- Next, please click on Service Hooks
- Please click on the green + (Add) button to create a new Hook
- An Add Hook dialog screen will appear, please use the scrolling navigation on the left-hand side to choose Web Hooks.
- Select the Triggers that correspond to the events that should execute an S4 scan of your repository. These are Pull Request Created and Pull Request Updated as follows:
10. The next screen requests a URL. For this please use https://s4.digitsec.com/azure/webhooks/<Azure Secret>. Remember this URL (including the Azure Secret) has been copied to the clipboard in Step 3. You can paste that in the URL field on the screen below. Your webhook URL should be similar to the diagram below.
11. You must now create a Personal Access Token (PAT). You will copy this token and enter it back into Edit Org Information Azure dialog screen we left open in Step 3. Please click the User Settings button in the top right corner of Azure DevOps.
- Then, click on Personal Access Tokens
- Then click New Token
- On the Personal Access Token (PAT) creation dialog screen, please set Name, Organization and Expiration parameters that meet your needs. To work with S4, set the Scope by selecting the Custom defined radio button, then the Read and Write radio button under the Code sub-header. Once the form is complete, press the Create button.
- Azure will present the PAT to you in cleartext. You should immediately copy it and save it to a local file. Azure will not display the PAT in cleartext again.
- Return to the window you opened in Step 3 and paste the Azure PAT into the corresponding field. To get your Azure Organization Name, Project Name and Repo Name please follow the directions below:
Username
Once you log in to your Azure DevOps account, the organization name is visible on the left side under the AzureDevOps settings as shown below:
Project Name
Click your preferred organization from the above picture and on the screen that opens up, your project names will be listed under the highlighted Projects tab as follows:
Repository Name:
Click the relevant Project from the above picture and on the screen that opens up, click Repositories
On the new screen that comes up, the repository names will be listed as shown below:
Once you have all this data, go back to step 3 and fill in the relevant information:
12. To verify this is working, please take an action that will activate the trigger you selected. Once you have finished this, the scan will have already begun. S4 will post a scan started comment as shown below:
13. Scans typically take between 5 and 15 minutes. S4 will send a notification email once the scan has completed which will include a link to your S4 Findings Detail Report.
14. The results from DigitSec will show up in the pull request comments as follows:
