contrast-security-oss/docs

Open Docs

Welcome to the Contrast Security Open Documentation project. The published site is located at docs.contrastsecurity.com. We encourage our community of users to contribute to our content library, and also let us know about mistakes and issues as you find them.

The project is part of the Contrast Openness Initiative, which consists of our Open API Architecture and our Open Documentation Library.

Contribute to the Project

Contributions can come in many ways. You can provide feedback on issues or submit your own requests for updates to articles. We simply ask that you review the guidelines for contribution before you begin.

What's in the Repository

The repository is the home for original markdown files, images and other assets. The source code for generating this project is derived from the Yeoman web scaffolding project called Assemble.

docs's Issues

typeahead race condition

If you start typing in the typeahead too soon after loading the page, you get errors that you cannot recover from without refreshing and trying again.

Uncaught TypeError: Cannot read property 'search' of undefined
    at c.i.length.i.typeahead.source (opendocs.49215c98af7f1381.js:1)
    at c.update (typeahead.jquery.min.4b525e49c674b812.js:7)
    at c (typeahead.jquery.min.4b525e49c674b812.js:7)
    at c.d (typeahead.jquery.min.4b525e49c674b812.js:7)
    at Function.each (jquery.min.js:2)
    at Object.each (typeahead.jquery.min.4b525e49c674b812.js:7)
    at a.update (typeahead.jquery.min.4b525e49c674b812.js:7)
    at c._onQueryChanged (typeahead.jquery.min.4b525e49c674b812.js:7)
    at typeahead.jquery.min.4b525e49c674b812.js:7
    at String.d (typeahead.jquery.min.4b525e49c674b812.js:7)

Order of Java Agent installation methods

Hi,

One of our customer followed Standard Installation of Java agent, and was trapped with maven installation though they do not use maven for development.
https://docs.contrastsecurity.com/installation-javastandard.html

I feel "Contrast UI" shall come first, and the rest (Maven Central, Debian Repository, and RPM Repository) comes later as optional like followings

Contrast UI
(optional) Maven Central
(optional) Debian Repository
(optional) RPM Repository

Thanks in advance.

BR,
Kaji

example.com --> your-email-domain.com

For the sake of consistency, can we please change example.com to your-email-domain.com here https://docs.contrastsecurity.com/admin-eop.html#update-license? Thanks

Typo on organizations page

On page: https://docs.contrastsecurity.com/user_tsguideset.html#orgs

"TeamServer is a multi-tenant architecture in which a single of software can support many communities of related or potentially unrelated customers"

Seems like there is a noun missing after the word "single". Should this say "a single piece of software" or "a single software product"?

Please add introductions to the Developer/Administrator/User sections

To help readers understand what you mean by these three roles, can you add intro sections for each of these to help explain how your have the documentation organized by these role. This should help make it easier for readers to understand the roles/organization scheme and thus find the right role to look under for documentation they are looking for.

Generic webhook placeholders

Would it be possible to list all the placeholders that are supported in generic webhooks in these docs along with what they get expanded to?

Currently it's not very clear if the $Title and $Message placeholders are the only ones supported and it is not clear what they expand to.

Maybe something like this would work?

Placeholder	Value
$Title	value it expands to
$Message	value it expands to

Left nav does not adjust when pasting a URL

From Jon S: The left nav menu isn't adjusting when you paste in a URL with anchor point, for example: https://docs.contrastsecurity.com/user_javainstall.html#tomcat. The relevant section does not show as expanded.

Top header menu options disappear on small screens

Add HTML-link-anchors to all H1/H2/H3

I want to tell a user to "for more information, read this
link".  However, the pages are long and I need to tell 
users "go to this page here and then scroll until you
see this section titled XYZ."

Add some user friendliness.  For all <h1> <h2>, 
add an HTML <a id="abc" name="abc" class="anchor">.  
You do this now for some <h1> elements.  I want this 
also for all <h2> elements.  

Also, add a clickable icon that exists in the <h1><h2> titles.  
So, I can click on that icon and it takes me to this anchor tag 
or it copies the URL#tag into the pasteboard.  Thus, it is easy
to copy the URL for sending to my users.

crawler memory

This https://docs.contrastsecurity.com/admin_crawlinstall.html#install says "minimum 1GB". But, I've never seen the crawler run with under 1.5GB at idle.

Please update.

what is DEFEND mode?

please explain what DEFEND mode means in the docs. If it's outdated please remove all references to it and update the docs so that they are current with the product

Configuring LDAP Authentication is Duplicated

The Configuring LDAP Authentication section seems to be duplicated in the docs.
https://docs.contrastsecurity.com/admin_tsconfig.html#ldap points to the first entry, which is immediately followed by an entry with the same name, which appears to be identical.

Image on: Downloading TeamServer From Contrast HUB too small

There is a warning message on this page (https://docs.contrastsecurity.com/admin_tsinstall.html#download), but its too small. Can it be made bigger so you don't have to click on it to read it?

Versions

Java versions and container versions do not seem to be updated. Java 11? Tomcat 9???

Vulnerability PDF report instructions are outdated

User > Teamserver > Guide > Report
@SteveFeldman instructions are no longer valid for new UI

edit-properties command line example incorrect

In both https://docs.contrastsecurity.com/admin_tsconfig.html#encrypt and https://docs.contrastsecurity.com/admin_tsconfig.html#backup , the command line example shows:

contrast@TeamServer:~/contrast/bin$ ./edit-properties -o jdbc.port -e ../data/esapi/ -f ../data/conf/ad.properties

Both should be "-o -p" instead.

Jira feature documented is not available

I find the following: Integrate Jira with Contrast to automatically generate tickets, synchronize comments and push notifications for your applications.

Snychronizing comments is not possible and confirmed by Simon from support. Maybe comments in docs refers to something else but most people will interpret this as the Discussion tab in vulnerabilities and / or the Comments field im Jira. And this feature is definitely not existing! Needs correction!

Send Library to bugtracker is not the latest

In the Manage Libraries(https://docs.contrastsecurity.com/user-libraries.html#manage-lib), the explanation and image for 'Send Library' dialog are not the latest. There is no 'Due Date' field, but 'Priority' and 'Reporters' fields.

Add description of ServerAdmin role to docs

This is not explained in our docs:

IntelliJ Plugin page is blank

Go to https://docs.contrastsecurity.com/tools-ide.html#intellij and you won't see anything.

Java install cloudfoundry instructions are out-dated

This no longer works:

git clone https://github.com/Contrast-Security-OSS/contrast-service-broker
cd contrast-service-broker
mvn clean package spring-boot:repackage -DskipTests=true

Deploy service broker app:

cf push contrast-security-service-broker -p /path/to/contrast-service-broker-.jar

Custom Rule How-to updates

The section https://docs.contrastsecurity.com/user_tsguideapp.html#rules is basically "whats new" and "animated gifs".

there needs to be instructions on how to use it. when the rules propagate outwards, etc etc.

IE10 and higher.

The team server is completely unusable on IE9. Please update https://docs.contrastsecurity.com/user_tsguideui.html#support to say IE10 and not IE9.

Update dotnetcore docs

Please address this

https://contrastsecurityinc.slack.com/archives/CFN7H4MHQ/p1574192268034100

Doc website has strange appearance in IE9 and FF40

Attached are screen shots of the website in both IE9 and FF40. The page is not fully drawn on screen. I'm not sure if this is because off-site components are blocked Corporate Proxy/Firewall or if the browser is too old. I think jquery and zendesk assists are properly loaded.

Java Agent System Properties - General Properties

Please add an example of exactly how to change one of these properties at the command line when launching the java agent? For example, show someone using: -Dcontrast.override.appname= when launching the java agent (e.g., -javaagent:path/to/contrast.jar). i.e., does it go after the -javagent? Before? Doesn't matter??

Contrast UI properties proxy settings error?

On this page: https://docs.contrastsecurity.com/installation-javaconfig.html#java-yaml

Under Configuration Options / Contrast UI properties are the proxy properties. The indenting for those properties looks wrong to me. If they are wrong, can you fix them?

If they are correct, can you make it more obvious they are correct?

Java Agent Documentation needs a High Level Custom Rules Section

Seems like there should be a higher level documentation topic called Custom Rules that is a peer to Troubleshooting (Similar to under .NET that has Level 2 Rules).

And under it, it should have an introduction that explains Level 2 and Level 3 rules. And then sections on Level 2 and Level 3 rules. The article: "How To Add A Level 2 Rule" should be moved under the Custom Rules section, as should: Advanced Rules Customization, that is currently under Configuration.

Seems like there really should be an outline something like this:

• Introduction:
• Writing Custom Level 2 Rules
• Configuring Contrast to Use Custom Level 2 Rules
• Writing Custom Level 3 Rules
• Example Level 3 Rules (With different examples for different scenarios)
  ** Like how to flag ALL uses of any method in a specific class or package
  ** How to flag instantiation of a subclass of a specific class
  ** Others you already have.
• Configuring Contrast to Use Custom Level 3 Rules

Screenshot of old UI

The screenshot of the "Organization View" on https://docs.contrastsecurity.com/user_tsguideui.html#overview uses the old Contrast UI/colors. I think the buttons are all the same, so minimal impact - just might be confusing to new users to see the old color scheme.

No discussion of CVE Shields in the docs

There should be a discussion of CVE Shields in the Policy Management section of our documentation

Typo in Organization View Table

In the "Component" column, "Vulnerabiity ID Search" should be "Vulnerability ID Search" (Vulnerability is missing the second 'L'). This is on https://docs.contrastsecurity.com/user_tsguideui.html#overview

Clarify Difference between API 1 and API 2

Can you add some clarification in both introductions as to the difference between the two versions and which I should use? If API 1 docs are simply obsolete, just say that so people can ignore them and only look at 2.

Add Pagerduty Integration to 3.6.7 release notes

images missing in `docs/content/user/apps/Session-metadata.md`

In View Data by Application section, please add images if possible.

Azure Devops Extension needs to be a Gate check.

While your extension is a good first step for integration. we need to have the check be in the Gate process of the release pipeline of Azure Devops. The stage should never start fro the deployment to an env if the project has issues. also all values need to be able to be passed a variables.
please work on this.
thanks,