CAST Report Generator - Table components - 1.11.0

Having populated the action plan from the Engineering Dashboard.

This component is only relevant on an engineering database. It is empty on an analytics database.

Having populated the action plan from the Engineering Dashboard.

This component is only relevant on an engineering database. It is empty on an analytics database.

• COUNT=N|ALL where N indicates the top N number ; default value = 10 (ALL for all violations)
•  NAME=FULL|SHORT to display short name or full name of objects (full name by default)
• FILTER=ADDED|SOLVED|PENDING|ALL to filter the list by the remedial action status; default is ALL

Display the list of AEFP

• TYPE = type of the function to display, DF for data function, TF for transactions, by default both are listed
• STATUS = status of the function to display, ADDED, MODIFIED or DELETED, all statuses by default
• COUNT = the number of lines to display, 10 by default (-1 for all functions)

List all the modified data function :

TABLE;AEFP_LIST;TYPE=DF,STATUS=MODIFIED,COUNT=-1

List the top 10 functions (data functions and transactional, added, modified and deleted)

TABLE;AEFP_LIST

Display the list of AETP

• COUNT = the number of lines to display, 10 by default (-1 for all functions)

List all the technical AEP :
TABLE;AETP_LIST;COUNT=-1

List the top 10 technical AEP :
TABLE;AETP_LIST

• HEADER=SHORT (here HEADER=SHORT) Indicates that short headers will be shown, obviously long headers will be shown

• PAR=ID where ID is the distribution ID

List of distributions :

• 65105 : Size Distribution
• 65350 : Coupling distribution
• 65501 : Cyclomatic complexity distribution
• 65601 : 4GL complexity distribution
• 65701 : OO complexity distribution
• 65801 : SQL complexity distribution
• 66010 : Reuse by call distribution
• 66015 : Class complexity distribution (WMC)
• 66020 : Class Fan-Out distribution
• 66021 : Class Fan-In distribution
• 67001 : Cost complexity distribution
• 67020 : distribution of violations to critical diagnostic-based metrics per cost complexity
• 67030 : distribution of defects to critical diagnostic-based metrics per cost complexity

• PAR=ID where ID is the distribution ID

cf CAST_DISTRIBUTION for list of distribution

• HEADER=SHORT (indicates that short headers will be shown, obviously long header will be shown)

Compliance to objectives.  This component is based on:

• Objectives – list of critical rules
• Achievement : if there is 0 violation for a critical rule
• Achievement ratio: # critical rules with 0 viol. / # critical rules

• HEADER=SHORT (indicates that short headers will be shown, obviously long header will be shown)

• PAR=N where N indicates the business criterion Id
• COUNT= number of results, if omitted, all results are returned

• HEADER=SHORT (by default HEADER=SHORT)
• SHOW_PREVIOUS=1 (by default SHOW_PREVIOUS=0)

• HEADER=SHORT (indicates that short headers will be shown, obviously long header will be shown)

List of added, deleted or updated components in application, module or technology

• STATUS = status of the components to display, “added”, “deleted” or “updated”, “added” by default
• COUNT = the number of lines to display, 10 by default (-1 for all components)
• MODULE = <module_name> if you want to filter components by module
• TECHNOLOGY = <technology_name> if you want to filter components by technology
• COMPLEXITY = to choose between “low”, “moderate”,”high” or “very high” if you want to filter by complexity (all by default)
• CURRENT = first snapshot name for the comparison if different from the current selected snapshot
• PREVIOUS = second snapshot name for the comparison if different from the previous selected snapshot

By default (without options), the list displayed the top ten added components for the application, between current and previous snapshots.
If module and technology are set in the same time, they will not be taken into account and list will be displayed for entire application

TABLE;DELTA_COMPONENTS_LIST_BY_STATUS
No options => list top 10 added artifacts for application between selected current and previous snapshots

TABLE;DELTA_COMPONENTS_LIST_BY_STATUS;STATUS=updated,COUNT=-1
List all updated artifacts for application between selected current and previous snapshots

TABLE;DELTA_COMPONENTS_LIST_BY_STATUS;STATUS=deleted,COMPLEXITY=very high
List top 10 deleted artifacts with very high complexity for application between selected current and previous snapshots

TABLE;DELTA_COMPONENTS_LIST_BY_STATUS;STATUS=updated,MODULE=MyModule
List top 10 updated artifacts for module MyModule between selected current and previous snapshots

TABLE;DELTA_COMPONENTS_LIST_BY_STATUS;STATUS=updated,TECHNOLOGY=.NET
List top 10 updated artifacts for technology .NET between selected current and previous snapshots

TABLE;DELTA_COMPONENTS_LIST_BY_STATUS;CURRENT=S2,PREVIOUS=S1
List top 10 added artifacts between snapshot S1 and snapshot S2

A Generic table component is built based on a table structure. The idea is to fill data into the table to populate it automatically

COL1=A,COL11=B,ROW1=C,ROW11=D,A=a,B=b,C=c|d,D=e|f|g

where A,B,C and D are one of the axis above

and a, b, c, d, e, f, g is one or multiple tags of the axis

See more information in section about Generic components (CAST Report Generator - Generic components - 1.11.0)

Depends on the selection.

See more information in section about Generic Components (CAST Report Generator - Generic components - 1.11.0)

• HEADER=SHORT (indicates that short headers will be shown, obviously long
• SHOW_EVOL=1 (displays a row indicating evolution as absolute values (delta), by default this row IS NOT displayed)
• SHOW_EVOL_PERCENT=0 (displays a row indicating evolution as relative values (percent), by default this row IS displayed)

• HEADER=SHORT (indicates that short headers will be shown, obviously long header will be shown)

• COUNT=N where N indicate the number of the top N (default value is all rows)
• TYPE=T where T is ‘TF’ for transactional functions, or ‘DF’ for data functions. If TYPE is not present (default), both types will be displayed

• COUNT=N where N indicate the number of the top N (no limit by default: all versions will be shown)

• FORMAT=LOC|KLOC, by default or if omitted, format is LOC

• COUNT=N where N indicate the number of the top N,
• PAR=BC-ID where BC-ID indicate the ID of the business criterion. PAR also supports several business criteria. Multiple business criteria are indicated as a list of BCID separated by “|”, for instance PAR=60011|60012
• IDX=i where i indicates the index of the specific rule wanted, for instance i=0 1st rule, i=1 2nd rule, i=3 3rd rule…

• HEADER=SHORT (here HEADER=SHORT) Indicates that short headers will be shown, obviously long headers will be shown

COL1=A,COL11=B,ROW1=C,ROW11=D,A=a,B=b,C=c|d,D=e|f|g

• where A,B,C and D are one of the axis above
• and a, b, c, d, e, f, g is one or multiple tags of the axis
• AGGREGATORS

See more information in section about Generic components (CAST Report Generator - Generic components - 1.11.0)

Depends on the selection.

See more information in section about Generic Components (CAST Report Generator - Generic components - 1.11.0)

• BF=T1 T2 T3 T4 T5 T6 T7 T8 where Tx is a target to fix regarding each line
• SLA=X Y where X is corresponding to the 2% and Y is corresponding to the 5% in the formula below

SLA Assessment thresholds :

• Good if % difference between Target and Actual is less than 2%
• Acceptable if & difference between Target and Actual is between 2% and 5%
• Poor if % difference between Target and Actual is greater than 5%

Actual score : average score using latest snapshot data (even if snapshot date is before current quarter

Target score: score to reach, to be configured as an option of the component

Score from previous quarter: average score using snapshot from previous quarter. If last snapshot date is old and previous current quarter, last snapshot date will be used also for previous quarter calculation

• COUNT=N where N is the shown technologies count (default value=5)
• ALT=N (where N is an health factor id - eg. 60017)

• BCID= The Id of the business criterion. If this id correspond to efficiency (60014), robustness (60013), or security (60016), the propagatedRiskIndex is displayed. By default, BCID = 60013
• ID= The Id of the quality rule for which you want to display the list of violations. By default, ID=7788 (Avoid empty catch block)
• COUNT=N where N indicates the top N number ; default value = 10
• NAME=FULL|SHORT to display short name or full name of objects (full name by default)
• SNAPSHOT=CURRENT|PREVIOUS to select from which snapshot we take results; default is Current

If there is no previous snapshot, column Status is not displayed

QUALITY_RULE_VIOLATIONS_BOOKMARKS

Updated in 1.11.0

List of violations for a rule with associated bookmarks

Updated in 1.11.0 : when there is an associated value of integer type, this value is also displayed

This component is only relevant on an engineering database. It is empty on an analytics database.

This component exists only for word document. The results would not be readable on powerpoint.

• ID= The Id of the quality rule for which you want to display the list of violations. By default, ID=7788 (Avoid empty catch block)
• COUNT=N where N indicates the top number of violations ; by default 5 (-1 correspond to all violations). All bookmarks from a violation are displayed.

If there is no previous snapshot, status is not displayed

List of violations with object name, type, status, file path and bookmark

QUALITY_STANDARDS_EVOLUTION

Updated in 1.11.0

• STD= Name of the parent quality standard you want the details, for example, CWE-2011-Top25 will list total, added and removed violations for standards CWE-22, CWE-78, CWE-79, CWE-89, CWE-134, CWE-327, CWE-434 and CWE-798.
• LBL=violations or vulnerabilities (vulnerabilities if not set), this change the headers from Vulnerabilities to Violations

Option added in 1.11.0

• MORE=true : add this one if you have specified a category in STD and want the evolution of the tags associated to this category (not specified by default). This option is valuable only when STD is a category (for example category = STIG-V4R8, tag = STIG-V4R8-CAT1). For a tag, there is no more data and the display is worse (for example tag = OWASP-2017 for which category=OWASP).

TABLE;QUALITY_STANDARDS_EVOLUTION;STD=CWE-2011-Top25
will list the tags associated with category CWE-2011-Top25 with total, added and removed number of violations

TABLE;QUALITY_STANDARDS_EVOLUTION;STD=STIG-V4R8,MORE=true
will list the categories and their associated tags with total, added and removed number of violations

QUALITY_TAGS_RULES_EVOLUTION

New in 1.11.0

• STD= Name of the quality standard category for which you want the details per tag, for example, STIG-V4R8-CAT1 will list total, added and removed violations for cast rules associated to all tags belonged to category STIG-V4R8-CAT1.
• LBL=violations or vulnerabilities (vulnerabilities if not set), this change the headers from Vulnerabilities to Violations

TABLE;QUALITY_TAGS_RULES_EVOLUTION
will list each quality standard tag associated to the quality standard category (with its number of total, added and removed violations), and for each tag, the list of associated CAST rules with numbers of total, added and removed violations

REMOVED_VIOLATIONS_LIST

Updated in 1.11.0

List of removed violations by Business Criterion

Updated in 1.11.0 with a filter on criticity

• BCID = name of the BCID to get the rule’s compounded weight and to filter results (60017 by default)
• COUNT = the number of lines to display, 50 by default (-1 for all removed violations)
• CRITICITY = c for only critical violations, nc for only non critical violations, all for critical and non critical violations (all by default if not configured)

TABLE;REMOVED_VIOLATIONS_LIST;BCID=60017,COUNT=10

All deleted critical violations for Robustness :
TABLE;REMOVED_VIOLATIONS_LIST;BCID=60013,COUNT=-1,CRITICITY=c

50 first non critical violations deleted for TQI :
TABLE;REMOVED_VIOLATIONS_LIST;BCID=60017,COUNT=50,CRITICITY=nc

50 deleted violations for BC Changeability (critical and non critical)
TABLE;REMOVED_VIOLATIONS_LIST;BCID=60012,COUNT=50,CRITICITY=all

• PAR=N where N indicate the Business Criterion Id
• COUNT=N where N is the number of the top N
• C=N where N represents the order of the result :
  • C=0 or nothing indicates a descending Improvement gap order
  • C=1 indicates a descending Improvement variation order
  • C=2 indicates a descending Degradation variation order

Formula is: (quality rule weight x technical criterion weight) * (4 – quality rule grade)

• RULID=N where N indicates the rule Id

RULE_NAME_DESCRIPTION_TOPCRITVIOL

or METRIC_NAME_DESCRIPTION

• COUNT=N where N indicate the number of the top N,
• PAR=BC-ID where BC-ID indicate the ID of the business criterion. PAR also supports several business criteria. Multiple business criteria are indicated as a list of BCID separated by “|”, for instance PAR=60011|60012
• IDX=i where i indicates the index of the specific rule wanted, for instance i=0 1st rule, i=1 2nd rule, i=3 3rd rule…

• PAR=N[|N]* where each submitted N indicate a business criterion ID

• BCID = name of the BCID to get the rule’s compounded weight (60017 by default)
• VARIATION = increase or decrease (decrease by default)
• DATA = number or percent (number by default)
• COUNT = the number of lines to display, 50 by default (-1 for all rules)

The formula are taken from the ones from CED :

• Decrease number : previous failed checks - current failed checks
• Decrease percent : current failed checks / current total checks - previous failed checks / previous total checks , display in percentage (*100)
• Increase number : current failed checks - previous failed checks
• Increase percent : previous failed checks / previous total checks - current failed checks / current total checks , display in percentage (*100)

TABLE;RULES_LIST_LARGEST_VARIATION;BCID=60017,

VARIATION=decrease,DATA=number,COUNT=50

RULES_LIST_STATISTICS_RATIO

Updated in 1.11.0

List of violations statistics by BC, TC or Standard Quality Tag

Updated in 1.11.0 : option added for not displaying added and removed columns

To use the quality standard tags selection, the Quality Standards Mapping extension should be installed on the central where the application resides.

When you select the metric id for a BC or TC, all the QRs belonging to this BC or TC is added for displaying violations

• METRICS=List of metrics id (BC, TC or QR) or quality standards tags separated by ‘|’.
• CRITICAL=true : add this option if you have selected a BC or a TC and want only critical rules to be selected (by default it is false). This option has no effect on selection by QR or quality standard tag.
• COMPLIANCE=true : add this option if you want to display the compliance score column ; by default this column is not displayed.
• SORTED=COMPLIANCE : add this option if you want to sort the data by compliance score, from worse to better ; by default the sort of data is from the max number of total violations to the min.
• LBL=violations or vulnerabilities (vulnerabilities if not set), this change the headers from Vulnerabilities to Violations
• EVOLUTION=true|false to display added and removed violations columns. By default or if not exists, is true (to keep compatibility with old version)

TABLE;RULES_LIST_STATISTICS_RATIO;METRICS=CISQ-Security,COMPLIANCE=true,LBL=violations

List the rules associated to quality tag A7-2017, without added and removed columns :
TABLE;RULES_LIST_STATISTICS_RATIO;METRICS=A7-2017,EVOLUTION=false

List of selected rules with total, added and removed violations, and optionnally the compliance ratio

LIST_RULES_VIOLATIONS_BOOKMARKS

Updated in 1.11.0

List of violations for a list of rules with bookmarks

Updated in 1.11.0 : when there is an associated value of integer type, this value is also displayed

This component is only relevant on an engineering database. It is empty on an analytics database.

This component exists only for word document. The results would not be readable on powerpoint.

To use the quality standard tags selection, the Quality Standards Support extension should be installed on the central where the application resides.

When you select the metric id for a BC or TC, all the QRs belonging to this BC or TC is added for displaying violations

• METRICS=List of metrics id (BC, TC or QR) or quality standards tags separated by ‘|’.
• CRITICAL=true : add this option if you have selected a BC or a TC and want only critical rules to be selected (by default it is false). This option has no effect on selection by QR or quality standard tag.
• COUNT=N where N indicates the top number of violations ; by default 5 (-1 correspond to all violations). All bookmarks of a violation are displayed.

If there is no previous snapshot, status is not displayed

• PAR=N where N indicate the Business Criterion Id
• COUNT=N where N is the number of the top N

Formula is : Sum (rule weight x technical criterion weight) * (4 – technical criterion grade)

• CNT=N where N indicates the shown rule number; if this item missed, no limitation will be applied
• TCID=N where N indicates the technical criterion Id
• BZID=N where N indicates the business criterion Id

• HEADER=SHORT (here HEADER=SHORT) Indicates that short headers will be shown, obviously long headers will be shown

• COUNT=N where N is the shown technologies count (default value=5)
• NOSIZE to hide the “LoC” column (default)

• COUNT=N where N is the shown technologies count (default value=5)

List of top components by properties

Can be used to replace CED reports :

• Top cyclomatic complexity x High Fan Out
• Top cyclomatic complexity x Low documentation

• PROP1 = name of first property, cyclomaticComplexity if not exists
• PROP2 = name of second property, fanOut if not exists
• ORDER1 = asc or desc for PROP1, desc by default
• ORDER2 = asc or desc for PROP2, desc by default
• COUNT = the number of lines to display, 50 by default (-1 or all is not allowed, it will take too much time and paper)

For PROP1 and PROP2, the available values are :

• codeLines,
• commentedCodeLines,
• commentLines,
• coupling,
• fanIn,
• fanOut,
• cyclomaticComplexity,
• ratioCommentLinesCodeLines,
• halsteadProgramLength,
• halsteadProgramVocabulary,
• halsteadVolume,
• distinctOperators,
• distinctOperands,
• integrationComplexity,
• essentialComplexity

If PROP1 and/or PROP2 is not correctly set,list of available values is displayed

• COUNT=N where N indicate the number of the top N,
• PAR=BC-ID where BC-ID indicate the id of the business criterion

• COUNT=N where N indicate the number of the top N,
• PAR=BC-ID where BC-ID indicate the id of the business criterion

• COUNT=N where N indicate the number of the top N

• COUNT=N where N indicate the number of the top N

• SRC= PERF| ROB|SEC : indicates the searched business criterion type
• MOD=N where N indicates the searched result will be applied on the module identified by this Id, and on the entire snapshot if this value isn’t indicated
• COUNT=N where N indicates the top N number ; default value = 10

• SRC=PERF|ROB|SEC : indicates the transaction type where top riskiest transactions will be searched
• COUNT=N where N indicates the top N number ; default value = 10

• HEADER=SHORT (here HEADER=SHORT) Indicates that short headers will be shown, obviously long headers will be shown

• ID=BC ID (by default ID is 60017)

• BCID= list of ids of business criterion, separated by | : 60011|60012|60013|60014|60016|60017 one or several ; default value = 60016 (Security)
• COUNT=N|ALL where N indicates the top N number ; default value = 10 (ALL for all violations)
• NAME=FULL|SHORT to display short name or full name of objects (full name by default)
• FILTER=ADDED|UNCHANGED|UPDATED|ALL to filter the list by the violation status; default is ALL
• VIOLATIONS=CRITICAL|ALL by default, only CRITICAL violations are listed
• MODULE=ModuleName, parameter used to restrict the list for one module, by default violation are listed for the application
• TECHNOLOGIES=techno1|techno2, parameter used to restrict the list of violations, by default all technologies

• MODULES=1|0 to display violations for the whole application (=0 by default) or per modules (=1)
• CRITICAL=1|0 to include critical violations (=1 by default) or not (=0)
• NONCRITICAL=1|0 to include the non-critical violations (=1) or not (=0 by default)
• GRADE=1|0 to show (=1 by default) or hide (=0) the “Grade” column - TOTAL=1|0 to show (=1 by default) or hide (=0) the “Total Checks” column
• FAILED=1|0 to show (=1) or hide (=0 by default) the “Failed Checks” column
• SUCCESSFUL=1|0 to show (=1) or hide (=0 by default) the “Successful Checks” column
• ADDEDREMOVED=1|0 to show (=1) or hide (=0 by default) the “Added” and “Removed” columns
• COMPLIANCE=1|0 to show (=1) or hide (=0 by default) the “Compliance Ratio” column
• COUNT=-1|N to display only N results, or all results if -1 (5 by default)