Fortify Audit Workbench: Secure Code Audit Workflow

Securing modern software means combing through thousands of static analysis alerts without drowning in false positives. When you run Fortify Static Code Analyzer (SCA) against a large codebase, it generates a massive Fortify Project Result file (.fpr). Reviewing that raw output directly in text editors or basic viewers wastes hours. Fortify Audit Workbench provides a specialized desktop interface designed to sort, filter, trace, and manage these vulnerabilities systematically.

Finding real threats hiding behind thousands of automated scanner alerts requires a repeatable evaluation process. This guide breaks down how to set up projects, navigate data flow traces, suppress false positives correctly, and streamline remediation so your development teams can fix actual risks before deployment.

Preparing Your Fortify Project Result (.fpr) File

Before you open Audit Workbench, your codebase needs to undergo static analysis via Fortify SCA. The analyzer parses your source files, builds an Abstract Syntax Tree (AST), and evaluates the control and data flow against security rulesets such as the OWASP Top Ten.

1. Translate the Code: Run sourceanalyzer with your project build commands to capture the compilation details into a translation store.
2. Execute the Scan: Run the analysis phase using up-to-date security rulepacks to produce the output .fpr file.
3. Launch Audit Workbench: Open the application executable and load the .fpr file. The interface displays the Project Summary dashboard, highlighting vulnerability counts grouped by severity, category, and package structure.

Navigating the Interface and Issue Viewer

When you open an .fpr file, the workspace divides into several core panes. Understanding how these panes interact prevents you from wasting time hunting through raw source files. To see the bigger picture, check out the detailed report by The New York Times.

• Issue Audit View: Displays the primary list of detected vulnerabilities. You can sort this list by confidence, severity, or custom tags.
• Analysis Trace View: Shows the exact path data travels from its untrusted source to the vulnerable sink. This step-by-step trace is critical for validating whether an alert represents a real flaw or a safe data path.
• Source View: Directly highlights the vulnerable line of code in context, letting you examine surrounding logic without switching windows.
• Details Pane: Provides vulnerability descriptions, recommendations for remediation, and references to standard security classifications like CWE.

Filtering and Prioritizing Vulnerabilities

Raw static scans often include high volumes of low-priority items or redundant alerts. Handling them one by one stalls remediation pipelines. Audit Workbench uses filter sets to streamline this review.

Group issues by package or sink type to tackle related vulnerabilities together. For instance, if you're reviewing SQL injection risks, filter the view to display only data flow anomalies terminating in database execution methods.

When you review an item, assign an explicit audit status:

• Issue State: Mark valid findings as Open or Reliable. Mark safe code paths or intentional behaviors as Not an Issue.
• Auditor Comments: Add notes directly into the project file explaining why a specific finding was suppressed. This documentation keeps security teams aligned during compliance audits.

Tracing Data Flow and Verifying Exploits

Static analysis engines make conservative assumptions about data sanitization. To confirm if a vulnerability is exploitable, use the Analysis Trace view to inspect every function call between the source and sink.

For example, suppose Fortify flags a potential Cross-Site Scripting (XSS) vulnerability in a user profile template. Select the alert and check the trace steps:

1. Locate the input source where user parameters enter the application controller.
2. Follow the data flow through intermediate helper functions and object mappings.
3. Check whether custom encoding or validation libraries sanitize the string before it reaches the UI output sink. If a robust validation method cleans the input earlier in the trace, the alert can be categorized safely as Not an Issue.

Integrating with Fortify Software Security Center (SSC)

Standalone desktop audits work well for single developers or isolated reviews, but enterprise environments demand centralized tracking. You can sync Audit Workbench directly with Fortify Software Security Center (SSC).

• Establish a secure connection URL to your corporate SSC instance within the preferences menu.
• Upload reviewed .fpr files to push audit decisions, custom tags, and suppression states back to the central server.
• Pull remote rule updates and shared custom filter definitions to maintain consistency across different development squads.

For official software updates and configuration manuals, check the OpenText Fortify Documentation portal.

Common Mistakes During Fortify Audits

Security teams often run into predictable bottlenecks when adopting desktop review workflows. Avoiding these pitfalls keeps your code review cycles efficient.

• Ignoring Custom Rules: Relying solely on default rulepacks misses proprietary business logic flaws. Write and import custom rules for internal APIs or custom cryptographic libraries.
• Bulk Suppressions: Never mark entire vulnerability categories as false positives without sampling individual traces. Blanket suppressions often hide critical zero-day logic flaws.
• Failing to Update Rulepacks: Outdated security content fails to catch modern vulnerability variants. Always pull the latest rulepacks from the OpenText MySupport portal before starting a fresh audit cycle.

Frequently Asked Questions

What is the difference between Fortify SCA and Audit Workbench?

Fortify Static Code Analyzer (SCA) is the command-line engine that scans source code and generates .fpr files. Audit Workbench is the graphical user interface used to open, filter, audit, and manage those results.

How do I handle false positives in Audit Workbench?

Select the flagged vulnerability, inspect its data flow trace to confirm it is safe, and change its review status to Not an Issue. Add a descriptive comment explaining why the code is secure so future auditors understand the decision.

Can Audit Workbench fix vulnerabilities automatically?

No. Audit Workbench is an analysis and triage tool. It provides remediation guidance and highlights vulnerable lines, but developers must rewrite the insecure code directly within their source files.

How do I share custom filter sets across my team?

You can export custom filter sets and project templates from Audit Workbench and import them into team workspaces or sync them through Fortify Software Security Center.