Run Nexus IQ scans

Nexus IQ performs Software Composition Analysis (SCA) to detect vulnerabilities, licence risks, and policy violations in open-source components used in your application.

Scans are typically executed as part of your CI/CD pipeline.

Prerequisites

Ensure the following:

• A Nexus IQ application has been created in Console.
  See Create Nexus IQ applications.

• You have the required Application ID and token for the application.
  See Manage Nexus IQ token.

• Your project uses a CI/CD pipeline.

Steps

1. Configure the Nexus IQ scan in your CI/CD pipeline using the SHIP-HATS template:

   NEXUS IQ GitLab pipeline template

   Note
   The Nexus IQ token contains <usercode:passcode>. Configure the following CI variables in your pipeline:

   • NEXUS_IQ_USERNAME = <usercode>
   • NEXUS_IQ_PASSWORD = <passcode>

2. Trigger your CI/CD pipeline.

   During the pipeline execution, Nexus IQ evaluates the application’s dependencies against configured policies.

3. Review the scan results in the Nexus IQ portal.

   1. Log in to Nexus IQ.
   2. Open the IQ Server Dashboard.
   3. Go to Reports.
   4. Select the required Application report.

   From the report, you can review:

   • Policy violations
   • Security vulnerabilities
   • Licence compliance risks

   You can also generate a PDF report if required.

Things to know

• Nexus IQ scans evaluate open-source dependencies used by your application.
• Policies configured in Nexus IQ determine whether a build passes or fails.
• If violations are detected, you can:
  • Fix the vulnerable dependency
  • Upgrade to a safer version
  • Waive the violation if approved by your organisation.

Related topics

• Create Nexus IQ applications
• Manage Nexus IQ token
• View Nexus IQ scan results
• Nexus IQ policies