Application Security - 3rd Party tools permissions

Provides visibility into supply chain security, including external tools integrated with your development pipeline and a catalog of known supply chain components.

Supply Chain Tools

External security tools integrated with your development pipeline (e.g., SonarQube, Snyk, Semgrep, Veracode, 3rd Party AppSec Collector). Shows tool status, risk factors, permissions, and version information. To access Supply Chain Tools, go to Modules → Application Security → 3rd Party Tools → Supply Chain Tools

| Permission | Description | Roles Example |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to Supply Chain Tools. | SOC Tier-1 and Tier-2 Analysts: Supply chain data is rarely needed for incident investigation at these tiers. |
| View | Read-only access to supply chain tools data. Users can browse, filter, and view tool details. They cannot add, configure, or remove tools. | <ul><li>SOC Tier-3 Analyst: May need to review supply chain tools during software supply chain attack investigations.</li><li>Threat Hunter: Reviews supply chain tools to identify potential supply chain attack vectors</li></ul> |
| View/Edit | Full access to manage supply chain tools. Includes all View capabilities plus: add new tools, configure tool settings, remove tools, and manage tool integrations. | Security Engineer: Manages supply chain tool integrations. |

Supply Chain Catalog

A catalog of known supply chain components and their security status, including pipeline tools discovered across CI/CD configurations. To access the Supply Chain Catalog, go to Modules → Application Security → 3rd Party Tools → Supply Chain Catalog.

| Permission | Description | Roles Example |
| ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to Supply Chain Catalog. | SOC Tier-1 and 2 Analysts: Supply chain data is rarely needed for incident investigation at this tier. |
| View | Read-only access to the supply chain catalog. Users can browse, filter, and view catalog entries. They cannot update or manage catalog entries. | <ul><li>SOC Tier-3 Analyst: May need to review the supply chain catalog during software supply chain attack investigations.</li><li>Threat Hunter: Reviews the supply chain catalog to identify potential supply chain attack vectors</li></ul> |
| View/Edit | Full access to manage the supply chain catalog. Includes all View capabilities plus: update catalog entries and manage catalog data. | Security Engineer: Reviews the catalog for risk assessment |

Required and recommended permissions

To effectively configure Application Security pipelines and investigate the resulting code vulnerabilities, administrators and analysts require visibility into the underlying VCS integrations, data sources, and issue queues. Consider adding the following permissions:

| Permission | Permission Level | Reason |
| ------------ | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Integrations | View or View/Edit | <ul><li>View: Recommended for Supply Chain Catalog to view integration context for catalog entries. Strongly recommended for Supply Chain Tools to view the tool integration status and connectivity</li><li>View/Edit: Strongly recommended for Supply Chain Tools to configure 3rd party tool integrations (Snyk, SonarQube, Semgrep, Veracode, etc.).</li></ul> |
| Data Sources | View | Recommended. View connected data sources for the catalog context and view connected data sources for the supply chain tool context. |
| Graph Search | View | Recommended for Supply Chain Catalog. Understand asset relationships for catalog components. |
| Threat Intel | View | Recommended for Supply Chain Tools. Correlate supply chain tool findings with threat intelligence. |