Set up your first SecureOne scan in guided steps

2) Prerequisites

• SecureOne panel is running and you can sign in as admin.
• At least one repository or CI/CD pipeline is available to scan.
• Scan agent host has Docker installed (if using agent-based scans).
• Tokens/credentials for Git provider and agent registration are ready.

3) Create Workspace

1. Sign in to SecureOne and open the dashboard.
2. Create (or select) your organization/workspace.
3. Set environment details (project name, deployment mode).
4. Confirm workspace appears in your left navigation/project switcher.

4) Connect Integrations

1. Go to Settings → Integrations.
2. Connect GitHub/Git provider app or token.
3. Verify repository access and choose target repositories.
4. Optionally connect CI/CD (for Jenkins or pipeline-triggered scans).

5) Register Scan Agent

1. Open Agents and generate registration/upload/heartbeat tokens.
2. Start the agent with your config and tokens.
3. Confirm agent status changes to Online.
4. Validate tool image settings (SAST/SCA/Secrets/DAST) if required.

6) Configure Scan

1. Open Scans → New Scan.
2. Select repository, branch, and scan types (SAST/SCA/Secrets/DAST).
3. Choose policy thresholds (e.g., fail on critical findings).
4. Save as a reusable template if your team runs similar scans.

7) Run First Scan

1. Trigger a manual scan from UI (or via pipeline if integrated).
2. Monitor queue, agent assignment, and execution status.
3. Wait until scan status shows Completed.

8) Review Findings

1. Open scan results summary (critical/high/medium/low counts).
2. Filter by severity, tool, file, and category.
3. Open individual findings to inspect evidence and remediation guidance.

9) Triage & Actions

1. Mark false positives where appropriate.
2. Create tickets/tasks for true positives.
3. Re-run scans after fixes and confirm issue closure.
4. Enable policy gates in CI/CD to prevent regressions.

10) Next Steps

• Add additional repositories and environments.
• Configure scheduled scans and notifications.
• Roll out role-based access for security and engineering teams.
• Track security posture trends in dashboard reports.