SonarQube for Secure SDLC and Azure DevOps Training Course

1. Fundamentals and Scope of Static Code Analysis

• Key definitions: static analysis, SAST, rule categories, and severity levels
• The role of static analysis in secure SDLC and risk mitigation
• How SonarQube aligns with security controls and developer workflows

2. SonarQube Overview: Features and Architecture

• Core services, database structure, and scanner components
• Best practices for Quality Gates, Quality Profiles, and governance
• Security features: vulnerabilities, SAST rules, and CWE mapping

3. Navigating the SonarQube Server UI

• UI walkthrough: projects, issues, rules, metrics, and governance views
• Interpreting issue details, traceability, and remediation advice
• Generating and exporting reports

4. Configuring SonarScanner with Build Tools

• Setting up SonarScanner for Maven, Gradle, Ant, and MSBuild
• Best practices for scanner properties, exclusions, and multi-module projects
• Generating required test data and coverage reports for accurate analysis

5. Integration with Azure DevOps

• Configuring SonarQube service connections in Azure DevOps
• Incorporating SonarQube tasks into Azure Pipelines and pull request decoration
• Ingesting Azure Repos into SonarQube and automating analyses

6. Project Configuration and Third-Party Analyzers

• Project-level Quality Profiles and rule selection for Java and Angular
• Managing third-party analyzers and plugin lifecycles
• Defining analysis parameters and parameter inheritance

7. Roles, Responsibilities, and Secure Development Methodology

• Role separation: developers, reviewers, DevOps, and security owners
• Creating a roles & responsibilities matrix for CI/CD processes
• Evaluating and recommending improvements to existing secure development methodologies

8. Advanced Topics: Adding Rules, Tuning, and Enhancing Security

• Using the SonarQube Web API to add and manage custom rules
• Tuning Quality Gates and enforcing automated policies
• Hardening SonarQube server security and access control practices

9. Hands-on Lab Sessions (Practical Application)

• Lab A: Configure SonarScanner for 5 Java repositories (Quarkus where applicable) and analyze outcomes
• Lab B: Configure Sonar analysis for an Angular front-end and interpret results
• Lab C: Full pipeline lab—integrate SonarQube with an Azure DevOps pipeline and enable pull request decoration

10. Testing, Troubleshooting, and Report Interpretation

• Strategies for generating test data and measuring coverage
• Common issues and troubleshooting scanner, pipeline, and permission errors
• How to read and present SonarQube reports to technical and non-technical stakeholders

11. Best Practices and Recommendations

• Selecting rule sets and implementing incremental enforcement strategies
• Workflow recommendations for developers, reviewers, and build pipelines
• Scaling SonarQube in enterprise environments

Summary and Next Steps