Integrating Acunetix 360 with GitLab CI/CD

GitLab is a web-based Git repository manager that provides CI/CD pipeline features, enabling you to add CI configuration to your source control repository using just one file.

You can integrate Acunetix 360 with GitLab using cURL or PowerShell scripts, generated by our Integration Script Generator. This topic explains how to generate and use cURL scripts to integrate Acunetix 360 with GitLab in order to enable our advanced integration functionality.

For further information, see What Systems Does Acunetix 360 Integrate With?.

Generating and Using Acunetix 360’s GitLab Integration Scripts

Acunetix 360 uses cURL and PowerShell command-line tools to integrate with GitLab. These scripts have been tested and approved for GitLab version 9+. In order to integrate with Acunetix 360, GitLab Runner’s execution environment must support cURL or PowerShell.

How to Generate Acunetix 360’s GitLab Integration Scripts

1. Log in to Acunetix 360.
2. From the main menu, go to Integrations > New Integration > GitLab CI/CD.

3. From the Integration Script Generator section, select the relevant Scan Settings:

• From the Scan Type field, select an option
• From the Website drop-down, select a website
• From the Scan Profile drop-down, select a scan profile (this is not displayed if you select Full with Primary Profile as the Scan Type)
• Enable the Stop the scan if the Build fails, if required
• Enable the Fail the Build if one of the selected scan severity is detected, if required

4. In the cURL field, click Copy to clipboard to copy the cURL script. (You will then paste this into the file described in the next How to.)

Using Build Fail in GitLab Project

It is possible to configure a failure in the GitLab build to stop the scan when a vulnerability severity is detected.

This can be configured using the Severity, Confirmed, False Positive, and Accepted Risk parameters.

1. Scan Severity: With this option, you choose which severity will fail this build when found in a related scan. If you choose “DoNotFail”, the detected vulnerability does not affect your GitLab build.

The options for Scan Severity are:

• DoNotFail
• Critical
• High or above
• Medium or above
• Low or above
• Best Practice or above
  

2. Confirmed: With this option, you choose to fail this build when a vulnerability found in a related scan is confirmed.

For example, if you choose the Medium or above option from the Scan Severity drop-down and select the Is Confirmed checkbox, the build fails only if the vulnerability has medium or higher severity and that vulnerability is confirmed. Otherwise, the build continues.

3. False Positive: With this option, you choose not to fail this GitLab build when the scan identifies a vulnerability set as a False Positive.

For example, if you choose the Medium or above option from the Scan Severity drop-down and select the False Positive checkbox, the build will not fail if the vulnerability has medium or higher severity and that vulnerability is false positive. Otherwise, the build fails.

4. Accepted Risk: With this option, you choose not to fail this GitLab build when the scan identifies a vulnerability set as an Accepted Risk.

For example, if you choose the Medium or above option from the Scan Severity drop-down and select the Accepted Risk checkbox, the build will not fail if the vulnerability has medium or higher severity and that vulnerability is accepted risk. Otherwise, the build fails.

How to Use Acunetix 360’s GitLab Integration Script

1. Log in to your GitLab account.
2. Navigate to your GitLab Project window.
3. Select Settings > CI / CD.
4. Expand the Variables section. Add your Acunetix 360 API credentials as USERID and APITOKEN variables.
5. Paste the copied script (from the previous How to) into your .gitlab-ci.yml file, as shown in the example. Then select Commit changes.

You can copy and paste the cURL script below into your .yml file and use it as an example.