Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
1. Foundations and Scope of Static Code Analysis
- Definitions: static analysis, SAST, rule categorization, and severity levels
- The role of static analysis in a secure SDLC and risk mitigation
- Positioning SonarQube within security controls and developer workflows
2. SonarQube Overview: Capabilities and Architecture
- Essential services, database structure, and scanner components
- Best practices for Quality Gates, Quality Profiles, and governance
- Security-centric features: vulnerability detection, SAST rules, and CWE mapping
3. Navigating the SonarQube Server Interface
- Tour of the Server UI: projects, issues, rules, metrics, and governance views
- Interpreting issue details, traceability, and remediation advice
- Generating and exporting reports
4. Configuring SonarScanner with Build Tools
- Setting up SonarScanner for Maven, Gradle, Ant, and MSBuild
- Best practices for scanner properties, exclusions, and multi-module projects
- Creating necessary test data and coverage reports for precise analysis
5. Azure DevOps Integration
- Establishing SonarQube service connections in Azure DevOps
- Implementing SonarQube tasks in Azure Pipelines and pull request decoration
- Importing Azure Repos into SonarQube to automate analysis
6. Project Setup and Third-Party Analyzers
- Selecting project-level Quality Profiles and rules for Java and Angular
- Managing third-party analyzers and the plugin lifecycle
- Defining analysis parameters and inheritance rules
7. Roles, Responsibilities, and Secure Development Methodology
- Role separation: developers, reviewers, DevOps, and security owners
- Creating a roles & responsibilities matrix for CI/CD processes
- Reviewing and recommending enhancements to existing secure development methodologies
8. Advanced Topics: Rule Management and Security Hardening
- Using the SonarQube Web API to create and manage custom rules
- Tuning Quality Gates and enforcing automated policies
- Best practices for SonarQube server security and access control
9. Practical Lab Sessions
- Lab A: Configure SonarScanner for five Java repositories (including Quarkus where relevant) and analyze outcomes
- Lab B: Set up Sonar analysis for one Angular front-end and interpret the results
- Lab C: End-to-end pipeline lab—integrating SonarQube with an Azure DevOps pipeline and enabling pull request decoration
10. Testing, Troubleshooting, and Report Analysis
- Strategies for generating test data and measuring coverage
- Resolving common issues related to scanners, pipelines, and permissions
- Effectively communicating SonarQube reports to both technical and non-technical stakeholders
11. Best Practices and Strategic Recommendations
- Selecting rule sets and implementing incremental enforcement
- Workflow recommendations for developers, reviewers, and build pipelines
- A roadmap for scaling SonarQube in enterprise settings
Summary and Future Steps
Requirements
- A solid grasp of the software development lifecycle
- Experience with source control and foundational CI/CD concepts
- Comfort with Java or Angular development environments
Target Audience
- Developers (Java / Quarkus / Angular)
- DevOps and CI/CD engineers
- Security engineers and application security reviewers
Testimonials (1)
Engaging, and hands on practise.
