Mastering Fortify Audit Workbench transforms how development and security teams handle application risk. Instead of drowning in endless static analysis alerts, you learn how to triage efficiently, filter out noise, and pinpoint actual security vulnerabilities before code reaches production.
When you run a static application security testing (SAST) scan using OpenText Fortify Static Code Analyzer (SCA), the tool outputs a .fpr results file. That raw file contains hundreds or thousands of findings. Audit Workbench provides the graphical desktop interface needed to inspect data flow, evaluate rules, and separate true threats from false positives.
Understanding the Fortify Architecture and Analysis Workflow
Static code analysis operates without executing your application. It parses source code into an abstract syntax tree, maps control flows, and tracks data flow paths from sources (where untrusted user input enters) to sinks (where dangerous operations occur).
Before you open Audit Workbench, your workflow follows a distinct sequence: Additional information regarding the matter are explored by Associated Press.
- Code Compilation and Translation: SCA translates source code into an intermediate format tailored for analysis, covering languages like Java, C/C++, Python, JavaScript, and C#.
- Rule Evaluation: The analyzer runs security rules against the translated codebase, checking for flaws mapped to standards like OWASP Top 10 and CWE.
- Result Packaging: The engine packages findings into a Fortify Project Results (
.fpr) file. - Auditing: You open this
.fprfile inside Audit Workbench to review, comment on, and assign remediation paths for every identified issue.
For official documentation and deep technical specs, check out the OpenText Fortify Documentation.
Launching and Navigating Audit Workbench
Once you install Audit Workbench and load your .fpr file, the workspace presents several pane views designed for specific analysis tasks.
- Issues View: Displays the categorized list of all discovered vulnerabilities, grouped by issue folder, vulnerability name, or data security risk level.
- Source Code View: Highlights the exact file and line number associated with the selected vulnerability trace.
- Analysis Trace View: Shows the precise sequence of steps—method calls, variable assignments, and conditional checks—that data travels from source to sink.
- Auditing Pane: Allows you to change issue status, assign reviewer comments, and set custom tags.
When you first open a large project scan, don't try to look at every single red warning flag. It's overwhelming and inefficient. Instead, rely on built-in filter sets to focus on high-confidence, high-severity findings first.
Triage Strategies: True Positives Versus False Positives
Distinguishing a genuine security flaw from a false positive requires understanding how data flows through your custom logic. Fortify evaluates code against generalized security rules that don't always know your application's internal sanitization mechanisms.
Here's how to conduct a rigorous analysis on a suspicious data flow:
- Trace the Source: Look at the Analysis Trace view to see where user input originates. Is it coming from an unvalidated HTTP parameter, a database field, or an internal configuration file?
- Verify Sanitization: Check whether intermediate methods sanitize or validate the input before it reaches a sensitive sink. If a custom validation method strips malicious payloads, Fortify might still flag it because it doesn't recognize your custom library.
- Assess Exploitability: Determine if the execution path is reachable by an unauthenticated or authenticated external attacker. If internal controls block external access entirely, adjust the issue status accordingly.
When you confirm an issue is a false positive, you don't just ignore it. You document the justification inside the audit project so future scans preserve your rationale or feed custom rule suppressions back into your security pipeline.
Advanced Filtering and Custom Issue Templates
Managing large projects means dealing with audit fatigue. Customizing filter sets helps teams focus exclusively on relevant code paths.
To build a custom filter set in Audit Workbench, open the filter panel and define rules based on specific criteria such as analyzer type, confidence level, or folder assignment. You can isolate vulnerabilities affecting specific packages while hiding third-party library code that your team doesn't directly maintain.
Furthermore, integrating your audit results with issue tracking platforms like Jira allows developers to turn verified security findings straight into actionable bug tickets. You can configure bug tracker connections directly within Audit Workbench preferences by supplying your issue tracking URL and authentication credentials.
Frequently Asked Questions
What is the difference between Fortify SCA and Audit Workbench?
Fortify Static Code Analyzer (SCA) is the underlying command-line engine that scans source code and generates the .fpr results file. Audit Workbench is the desktop graphical user interface used to open, inspect, filter, and audit those scan results.
How do I handle custom sanitizers that Fortify flags as vulnerabilities?
If your application uses custom sanitization routines that Fortify doesn't recognize out of the box, you can write custom cleanse rules or document audit justifications. Over time, you can share these custom rules and filter templates across your engineering organization.
Can multiple developers audit the same project file concurrently?
Yes. Audit Workbench supports collaborative auditing workflows. Teams can merge audit data from multiple reviewers using command-line utilities or synchronize results back to an enterprise server like Fortify Software Security Center (SSC).
How often should security content rules be updated?
You should update your Fortify security content rules regularly—ideally before every major release cycle. Rule updates incorporate new vulnerability signatures, updated OWASP standards, and improved detection logic for modern software frameworks.
