Code Dx Enterprise のサポート対象ツール
サポート対象ツール一覧（2020/03/19現在）
Code Dx Enterprise がサポートする対象の各種ツールの内、SAST/DAST/IAST/InfraSec/Compositionに該当するツールは下表の通りです。
本表では、Code Dx EnterpriseのカタログとUser Guideに掲載されているツールを包括的に再度構成して一覧にしました。合わせて、Code Dx Enterprise本体とツールの関係を示すために、以下の情報を併記しました。どのようなツールをどのように組み合わせて使えるかを、本表でご確認になれます。
- 「バンドル」の対象かどうか（バンドル対象のツールは、お客様でのインストールは不要(*1)）
- Code Dx Enterpriseが、ツールの解析結果データをImportするのか、あるいは、Connector経由で入力するのかの区別
- ツール側がインターネット接続を必要とするかどうか
本表は、タイトル欄の▲▼マークをクリックすることで、その欄のデータをキーに昇順あるいは降順にソートすることが出来ます。特に、欄の内容がキーワードや記号になっている場合に、分類を確認するときに便利にしております。
表の見方（各欄の意味、表の操作）詳細については、「サポート対象ツール一覧の見方」をご参照下さい。
*1 CAT .NETおよびFxCopについては、ライセンス上お客様ご自身でインストールして頂く必要があります。Code Dx Enterpriseはこれらツールのインストール状況を確認して、インストールされていれば自動的にツールを使うように動作します。
| ツール名 | ツール・ タイプ | 対象言語 | 主な用途 | ライセンス | バンドル 対象 | Import 対象 | Connector 対象 | Internet 必要 | 備考 |
|---|---|---|---|---|---|---|---|---|---|
| Acunetix | Dynamic Analysis | WebSites, WebApps | Security | Commercial | ○ | ||||
| AndroidLint | Static Analysis | Android Platform Development | Quality, Security | OSS | ○ | ||||
| AppDetective Pro | InfraSec | WebSites | Security | Commercial | ○ | ||||
| AppScan | Dynamic Analysis | WebApps, WebServices | Security | Commercial | ○ | HCL AppScan on Cloud(ASoc) | |||
| AppScan Source | Static Analysis | C/C++, COBOL, Java, JavaScript, Perl, PHP, .NET (C#, ASP.NET,VB.NET), ASP, VB | Security | Commercial | ○ .ozasmt file | ||||
| AppSpider | Dynamic Analysis | WebApps | Security | Commercial | ○ | ||||
| Arachni | Dynamic Analysis | WebApps | Security | OSS | ○ | ||||
| Black Duck Hub | Composition Analysis | C, C++, C#, Clojure, Erlang, Golang, Groovy, Java, JavaScript, Kotlin, Node.js, Objective-C, Swift, Perl, Python, PHP, R, Ruby, Scala, Swift, .NET Cloud technologies | Security | Commercial | ○ | ○ | ○ | ||
| Brakeman | Static Analysis | Ruby | Security | OSS | ○ | ○ | |||
| Burp Suite | Dynamic Analysis | WebApps | Security | Commercial | ○ | ||||
| CheckMarx | Static Analysis | C, C++, Java, .NET, ASP, VB, PHP, JavaScript, Ruby, VBScript, Perl, Objective-C, Python, Groovy | Security | Commercial | ○ | ○ | |||
| Checkstyle | Static Analysis | Java | Quality | OSS | ○ | ○ | |||
| Cigital | Dynamic Analysis | Security | Commercial | ○ | ○ | ||||
| Clang | Static Analysis | C, C++, Objective-C, Objective-C++ | Quality | OSS | ○ | ||||
| CodePeer | Static Analysis | Ada | Security | OSS | ○ | ||||
| CodeSecure | Static Analysis | PHP | Security | Commercial | ○ | Security as a service by Armorize | |||
| Contrast Assess | Dynamic Analysis | Security | Commercial | ○ | |||||
| cppcheck | Static Analysis | C, C++ | Quality | OSS | ○ | ○ | |||
| Embold | Static Analysis | C/C++, C#, Java, Objective C, JavaScript, typeScript, Python, PHP, Go, Kotlin, Solidity, SQL | Quality, Security | Commercial | ○ | CMS-3 Supported | |||
| errCheck | Static Analysis | Go | Quality | OSS | ○ | ||||
| Error Prone | Static Analysis | Java | Quality | OSS | ○ | Java Compilerに含まれる | |||
| ESLint | Static Analysis | JavaScript | Quality | OSS | ○ | ○ | |||
| Find Security Bugs | Static Analysis | Java | Quality, Security | OSS | ○ | SoptBugs/ FindBugs Plugin | |||
| FindBugs | Static Analysis | Java | Quality | OSS | ○ | カタログのみ:SpotBugsに継続 | |||
| Gamma Tech CodeSonar | Static Analysis | C, C++, Java | Quality, Security, Standards | Commercial | ○ | ○ | |||
| Gendarme | Static Analysis | .NET | Quality | OSS | ○ | ○ | |||
| GoCyclo | Static Analysis | Go | Quality | OSS | ○ | ||||
| GoLint | Static Analysis | Go | Quality | OSS | ○ | ||||
| GoSec | Static Analysis | Go | Security | OSS | ○ | ||||
| IneffAssign | Static Analysis | Go | Quality | OSS | ○ | ||||
| JLint | Static Analysis | Java | Quality | OSS | ○ | ||||
| JSHint | Static Analysis | JavaScript | Quality, Standards | OSS | ○ | ○ | |||
| Klocwork | Static Analysis | C, C++, java, .NET | Quality, Security | Commercial | ○ | CMS-3 Supported | |||
| Lattix | Static Analhysis | C/C++, Java, .NET, Ada, Fortran, ActionScript, JavaScript, Pascal, Python | Architecture | Commercial | ○ | CMS-3 Supported | |||
| Micro Focus Fortify Static Code Analysis | Static Analysis | All Manor Languages(23+ supported) | Security | Commercial | ○ | ○ | |||
| Micro Focus Fortify WebInspect | Dynamic Analysis | WebApps | Security | Commercial | ○ | ||||
| Microsoft Code Analysis Tool(CAT) .NET | Static Analysis | Managed Code(C#, VB.NET, J#) | Security | OSS | ○ (User Installed) 備考参照 | ○ | ユーザ側でインストール必要。 | ||
| Microsoft FXCop | Static Analysis | .NET, C# | Quality, Security | OSS | ○ (User Installed) 備考参照 | ○ | ユーザ側でインストール必要。 | ||
| NetSparker | Dynamic Analysis | WebApps | Security | Commercial | ○ | ||||
| Netsparker Cloud | Dynamic Analysis | Security | Commercial | ○ | |||||
| NMap | InfraSec | WebSites | Security | Commercial | ○ | ||||
| NowSecure | Static Analysis | Quality, Security | Commercial | ○ | |||||
| OCLint | Static Analysis | C, C++, Objective-C | Quality | OSS | ○ | ||||
| OWASP Dependency-Check | Composition Analysis | Java, .NET Experimental( Python, Ruby, PHP (composer), Node.js, C/C++):config required | Security | OSS | ○ | ○ | ○ | ||
| OWASP ZAP | Dynamic Analysis | WebApps | Security | OSS | ○ | ||||
| Parasoft C++Test | Static Analysis | C, C++ | Quality, Security, Standard | Commercial | ○ | ||||
| Parasoft dotTest | Static Analysis | .NET, C#, VB.NET, ASP.NET, Managed C | Quality, Security, Standard | Commercial | ○ | ||||
| ParaSoft JTest | Static Analysis | Java | Quality, Security, Standards | Commercial | ○ | ||||
| PGRelief | Static Analysis | C/C++, Java | Quality, Security | Commercial | ○ | CMS-3 Supported | |||
| PHP Codesniffer | Static Analysis | PHP, JavaScript, CSS | Standards | OSS | ○ | ○ | |||
| PHP MD | Static Analysis | PHP | Quality | OSS | ○ | ○ | |||
| PHPcs-audit-security | Static Analysis | PHP | Security | OSS | ○ | CodeSniffer Rules | |||
| PMD | Static Analysis | Java, XML, XSL | Quality | OSS | ○ | ○ | |||
| PMD GDS Security | Static Analysis | Java | Security | OSS | ○ | Rule set for PMD | |||
| Polyspace | Static Analysis | C/C++, Ada | Security | Commercial | ○ | CMS-3 Supported | |||
| Protecode | Composition Analysis | Security | Commercial | ○ | |||||
| PyLint | Static Analysis | Python | Quality | OSS | ○ | ○ | |||
| QA・C | Static Analysis | Quality, Security | Commercial | ○ | CMS-3 Supported Helix QACに変更 |
||||
| Qualys VM | InfraSec | WebSites | Security | Commercial | ○ | ○ | InfraSec Add-on | ||
| Qualys WAS | Dynamic Analysis, IAST | Security | Commercial | ○ | |||||
| Retire.js | Composition Analysis | JavaScript | Security | OSS | ○ | ○ | |||
| safeSQL | Static Analysis | Go | Security | OSS | ○ | ||||
| ScalaStyle | Static Analysis | Scala | Quality, Standards | OSS | ○ | ○ | |||
| SonarQube | Securty | Commercial | ○ | ||||||
| SonaType Nexus | Composition Analysis | OpenSource components | Security | Commercial | ○ | ○ | |||
| Sparrow | Static Analysis | Java, JSP, JavaScript, C#, ASP.NET, Objective-C, PHP, VBScript, HTML | Quality, Security | Commercial | ○ | CMS-3 Supported | |||
| SpotBugs | Static Analysis | Java | Quality | OSS | ○ | ○ | Findbugs後継 | ||
| Staticcheck | Static Analysis | Go | Security | OSS | ○ | ||||
| Synopsys Coverity | Static Analysis | C, C++, C#, Objective-C, Java, JavaScript | Quality, Security, Standard | Commercial | ○ | ○ | |||
| Tenable Nessus | InfraSec | WebSites | Security | Commercial | ○ | ||||
| Trustwave App Scanner | Security | Commercial | ○ | ||||||
| Veracode (Dynamic) | Dynamic Analysis | Security | Commercial | ○ | ○ | Composition Analysis もあり | |||
| Veracode (Static) | Static Analysis | C/C++, Java, .NET (C#, ASP.NET,VB.NET), JavaScript, Python, PHP, Ruby, Objective-C, VB | Security | Commercial | ○ | ○ | Dynamic、Composition Analysis もあり | ||
| vet | Static Analysis | Go | Quality | OSS | ○ | ||||
| Vex WAS | Dynamic Analysis | WebApp | Security | Commercial | |||||
| WhiteHat Sentinel Source | Static Analysis | Java, C#, Objective-C, JavaScript, PHP, ASP.NET, HTML5 | Security | Commercial | ○ | 別途、Dynamicもあり。 |