While you cannot directly customize Auto DevOps, you can [include the Auto DevOps template in your project's `.gitlab-ci.yml` file](../../topics/autodevops/customize.md#customizing-gitlab-ciyml).
## Quick start
## Security scanning without Auto DevOps
Get started quickly with Dependency Scanning, License Scanning, Static Application Security
To enable all GitLab security scanning tools, with the option of customizing settings, add the
Testing (SAST), and Secret Detection by adding the following to your [`.gitlab-ci.yml`](../../ci/yaml/README.md):
GitLab CI/CD templates to your `.gitlab-ci.yml` file.
To enable Static Application Security Testing, Dependency Scanning, License Scanning, and Secret
Detection, add:
```yaml
```yaml
include:
include:
...
@@ -34,8 +73,8 @@ include:
...
@@ -34,8 +73,8 @@ include:
-template:Security/Secret-Detection.gitlab-ci.yml
-template:Security/Secret-Detection.gitlab-ci.yml
```
```
To add Dynamic Application Security Testing (DAST) scanning, add the following to your
To enable Dynamic Application Security Testing (DAST) scanning, add the following to your
`.gitlab-ci.yml` and replace `https://staging.example.com` with a staging server's web address:
`.gitlab-ci.yml`. Replace `https://staging.example.com` with a staging server's web address:
```yaml
```yaml
include:
include:
...
@@ -45,17 +84,8 @@ variables:
...
@@ -45,17 +84,8 @@ variables:
DAST_WEBSITE:https://staging.example.com
DAST_WEBSITE:https://staging.example.com
```
```
To ensure the DAST scanner runs *after* deploying the application to the staging server, review the [DAST full documentation](dast/index.md).
For more details about each of the security scanning tools, see their respective
| [Container Scanning](container_scanning/index.md)**(ULTIMATE)** | Scan Docker containers for known vulnerabilities. |
| [Dependency List](dependency_list/index.md)**(ULTIMATE)** | View your project's dependencies and their known vulnerabilities. |
| [Dependency Scanning](dependency_scanning/index.md)**(ULTIMATE)** | Analyze your dependencies for known vulnerabilities. |
| [Dynamic Application Security Testing (DAST)](dast/index.md)**(ULTIMATE)** | Analyze running web applications for known vulnerabilities. |
| [API fuzzing](api_fuzzing/index.md)**(ULTIMATE)** | Find unknown bugs and vulnerabilities in web APIs with fuzzing. |
| [Secret Detection](secret_detection/index.md) | Analyze Git history for leaked secrets. |
| [Security Dashboard](security_dashboard/index.md)**(ULTIMATE)** | View vulnerabilities in all your projects and groups. |
| [Static Application Security Testing (SAST)](sast/index.md) | Analyze source code for known vulnerabilities. |
| [Coverage fuzzing](coverage_fuzzing/index.md)**(ULTIMATE)** | Find unknown bugs and vulnerabilities with coverage-guided fuzzing. |
### Use security scanning tools with Pipelines for Merge Requests
### Use security scanning tools with Pipelines for Merge Requests
The security scanning tools can all be added to pipelines with [templates](https://gitlab.com/gitlab-org/gitlab/-/tree/master/lib/gitlab/ci/templates/Security).
See each tool for details on how to use include each template in your CI/CD configuration.
By default, the application security jobs are configured to run for branch pipelines only.
By default, the application security jobs are configured to run for branch pipelines only.
To use them with [pipelines for merge requests](../../ci/merge_request_pipelines/index.md),
To use them with [pipelines for merge requests](../../ci/merge_request_pipelines/index.md),
you may need to override the default `rules:` configuration to add:
you may need to override the default `rules:` configuration to add:
