Connection Settings

Fill in you User and Password of your Kiuwan Account and click Check Credentials to validate access.

In case you are using a proxy, please configure Proxy Settings.

Analysis Filters

This configuration is general to K4D installation, but you can configure analysis filters per-application. 

To do it,  go to Project >> Properties >> Kiuwan >> Analysis Filters and click on Enable project specific settings

Mapping your Eclipse project to Kiuwan Application

After K4D is installed and connection is configured, you are ready to map your Eclipse project to a Kiuwan application.

To map your Eclipse project to Kiuwan, you can do it in several ways:

1. Project >> Properties
2. Right-click on your project and select Configure >> Convert to Kiuwan Project...
3. Right-click on your project and select Properties.

Next dialog will be open.

To map your Eclipse project to a Kiuwan Application allows to execute K4D analysis synced to the Kiuwan Model defined at application level.

This means that K4D analysis will be executed with the same Model (rules, configuration, etc.) defined for for the Kiuwan application.

Please visit Models Manager User Guide for further help on Kiuwan Models.

Also, mapping your project to a Kiuwan Application allows to download defect list found by Kiuwan servers to you Eclipse, so you can work locally on fixing those defects.

Local defects list

Vulnerabilities details (Source and Sink) 

Local Analysis Configuration

K4D will execute the analysis with the rules contained into the model associated to the mapped Kiuwan application.

But K4D also allows you to reduce the scope of the analysis to a subset of that model.

When you execute the local analysis on your Eclipse project, the number of defects can be quite large. If you are not going to work on all of them, you should consider to reduce the analysis to to let you concentrate on the most important subset of defects. K4D allows you to configure the local analysis to only report defects based on Priority, Characteristic, Language or even a subet of file (based on file path substring)

This would allow you to concentrate on a specific set of rules or files, reducing the number of defects that appear in the list. Only those defects matching the filters will be displayed.

You can access Local Analysis Configuration by clicking on  icon of Local Defects list. 

Note: All the options unchecked are equivalent to all checked.

Configuring Defects View

Regardless of you have configured the subset of defects of K4D analysis (see above), you can further reduce the defects view by defining additional filtering conditions.

Most important filter is Scope:

• File option will only display defects of the selected file in the Eclipse source file editor
• Project option will display the defects of the entire project

Additionally, you can define filters based on Priority, Characteristic and Language.

You can define view filters by clicking on   icon of Local Defects list. 

Note: All the options unchecked are equivalent to all checked.

Server defects list

Besides to configure the source of server defects, you can further filter server defects to be downloaded based on Priority, Characteristic, Language or File Pattern

Configuring Filters

Besides to configure source and filters, you can further reduce the server defect list by defining additional filtering conditions.

You can define view filters by clicking on   icon of Server Defects list.

Note: All the options unchecked are equivalent to all checked.

An important filter is Scope:

• File option will only display defects of the selected file in the Eclipse source file editor
• Project option will display the defects of the entire project

Additionally, you can define filters based on Priority, Characteristic and Language.

Because your source code could be different to the  source code of the analysys server, it might happens that some server defects could not match your current source code.

In these cases, you can filter by Orphan defects to display only those defects matching your currrent source code (defects with associated local resource) or those that doesn't (defects without associated local resource), or all of them.

A server defect could have been muted (for exmple, because it's a false positive or because it's a so special condition that must not be fixed). In these cases, you can use the Muted filter.

Any server defect may have an associated Life Cycle Status (To Review, Reviewed, or None) . When server defects are downloaded, you can filter defects based on their status. 

If you work on a to-review server defect, right-clicking on the defect you can "Mark as reviewed locally" that defect (see image below), and filter the defect list using Reviewed locally filter.

Then, that defect will be marked as "Reviewed locally"