User Guide
Introduction
User roles
SAST Aviator includes sequential procedures and involves different user roles in your organization.
The user roles involved are:
l
Customer administrator: Customer administrator can create an admin configuration, create and
manage tokens, and manage applications and entitlements.
l
Customer user: User can create a user session and trigger an audit.
Note: Before using the fcli, you must be registered with OpenText. OpenText Support creates
and registers the tenant upon your initial purchase of SAST Aviator.
Entitlement model
SAST Aviator is a paid service. The SAST Aviator models available for purchase are per Developer
and per Application.
l
per Application: The basic entitlement model is per Application. You can run any number of
audits for a single application. Therefore, the customer administrator must ensure to register, that
is, create applications in the tenant. SAST Aviator monitors the number of entitlements for the
respective tenant every time a Fortify Project Report (FPR) is processed.
l
per Developer: SAST Aviator cannot monitor developers. By default, a maximum of four
applications per ten developers are allocated. If this allocation does not meet your requirements,
contact your account representative.
For every new purchase of the SAST Aviator entitlement, OpenText Support updates the number of
entitlements for the respective tenant.
Limitations
When presented with SAST results containing extremely large numbers of issues, certain limits will
apply to SAST Aviator’s auditing.
This is very similar to how auditing by a human practically works. If there are hundreds of issues, they
can be audited manually. But if there are thousands, that’s neither practical nor useful. The first
response should be to look for patterns. A recurring bad coding pattern may cause many true
positives. In that case, the code should be fixed in bulk. Alternatively, some rule in SAST may trigger
massive false positives for that particular codebase. In that case, the SAST scan configuration should
be adjusted. After these steps, a smaller number of remaining findings can be audited individually.
SAST Aviator has largely been designed as an AI-powered version of a human auditor. It will not
blindly audit an unlimited number of issues. Practically, such a limit is also necessary, given the non-
trivial resource consumption for every issue audited.
The following limits apply:
Page 8 of 29
OpenText™ Core SAST Aviator (25.2.0)