Vigilnz Security

Vigilnz Security Plugin integrates comprehensive security scanning capabilities into Jenkins CI/CD pipelines.

• Multiple Scan Types: Support for SCA, SBOM, SAST and more
• Secure Credential Management: Store and manage Vigilnz API credentials securely
• Freestyle & Pipeline Support: Works with both traditional and modern Jenkins jobs
• Detailed Results: View scan results directly in the Jenkins build sidebar
• ️ Flexible Configuration: Select which scan types to run per build
• Credential Management: Automatic refresh and caching

• Jenkins 2.528.3 or later
• Java 17 or later
• Vigilnz API access (API key required)

To use the plugin you will need to take the following steps in order:

1. Install the Vigilnz Security Plugin
2. Generate API Key From Vigilnz Security
3. Configure a Vigilnz API Key Credential
4. Add Vigilnz Security to your Project
5. View Your Vigilnz Scan Report

1. Go to Manage Jenkins → Manage Plugins
2. Search for "Vigilnz Security"
3. Click Install without restart or Download now and install after restart

1. Download the latest .hpi file from GitHub Releases
2. Go to Manage Jenkins → Manage Plugins → Advanced
3. Upload the .hpi file under Upload Plugin
4. Restart Jenkins

1. Login to the Vigilnz application.
2. Navigate to Settings → API Keys.
3. Click Generate New Key or View API Key (If exits).
4. Copy the API Key and store it securely.

1. Go to Manage Jenkins → Manage Credentials
2. Click Add Credentials
3. Select Vigilnz Security Token from the kind dropdown
4. Enter:
   • Token: Your Vigilnz API key
   • ID: Unique identifier (optional, auto-generated if not provided)
   • Description: Description for this credential
5. Click OK

1. Create a new Freestyle project or edit an existing one
2. In Build Steps, click Add build step → Invoke Vigilnz Security Task
3. Configure:
   • Credentials: Select your Vigilnz credential
   • Target File: (Optional) File or path to scan
   • Scan Types: Select at least one scan type (SCA, SAST, SBOM)
4. Save and run the build

pipeline {
    agent any

    stages {
        stage('Security Scan') {
            steps {
                vigilnzScan(
                    credentialsId: 'my-vigilnz-creds',
                    scanTypes: 'sca,sast,sbom'
                )
            }
        }
    }
}

• SCA: Software Composition Analysis
• SBOM: Software Bill of Materials
• SAST: Static Application Security Testing
• IAC: Infrastructure as Code — checks configuration files (Terraform, Kubernetes, etc.) for misconfigurations.
• SECRET SCAN: Secret Detection — finds hardcoded credentials, API keys, and sensitive information in source code.

1. Sidebar Summary: View a quick summary in the build page sidebar
2. Full Details: Click "Vigilnz Scan Results" in the sidebar to see complete scan results
3. Console Output: Check the build console for detailed scan logs

vigilnzScan(
    credentialsId: 'my-vigilnz-token',
    scanTypes: 'sca'
)

vigilnzScan(
    credentialsId: 'my-vigilnz-token',
    scanTypes: 'sca,sast,sbom,iac,secret'
)

pipeline {
    agent any

    stages {
        stage('Security Scan') {
            steps {
                withCredentials([string(credentialsId: 'vigilnz-token', variable: 'VIGILNZ_TOKEN')]) {
                    vigilnzScan(
                        credentialsId: 'vigilnz-token',
                        scanTypes: 'sca,sast'
                    )
                }
            }
        }
    }
}

• Verify your API key is correct
• Check that the authentication URL is accessible
• Ensure the API Key has not expired

• At least one scan type must be selected
• Check the checkbox selections in the build configuration

• Ensure the build completed successfully
• Check the build console for any errors
• Verify the API response was successful

• Issues: Report issues on GitHub Issues
• Documentation: Plugin

• Initial release
• Support for SCA, SAST, SBOM, IAC, Secret scan types
• Freestyle and Pipeline job support
• Secure credential management
• Build sidebar results display

Licensed under MIT License. See LICENSE for details.