The speed of our support team's response time depends on the priority level you select when you submit your ticket. Your ticket priority level can be changed by CodeSecure support to be higher or lower based on how an issue impacts your business.

Note: In cases where support is purchased through a CodeSecure-authorized reseller, the reseller will provide technical support to the customer as defined in their own separate agreement.

Note: If you have purchased Premium Support then the response times will differ from Standard Support.

Response Times

Business Hours

Standard support services via electronic mail or via the support portal are between the hours of 9:00 AM and 6:00 PM, U.S. Eastern time, Monday through Friday excluding US public holidays.

Issue Priority 

Incident priority for a defect is determined using the guidelines below. When logging a ticket via the support portal the priority is classified as defined in brackets below.

You can set the priority of a ticket when submitting via the support portal which will require you to login with a registered account. However, CodeSecure reserves the right to reclassify the priority level at any time if we reasonably believe the classification is incorrect. Re-classifications are almost exclusively used in situations where a ticket is submitted as Urgent, usually a non-production setup issue, or how-to question.

CodeSecure support may also increase the priority level if the situation is deemed to be more urgent than originally reported. If you do not choose a priority level when you create a ticket, it will default to standard (normal).

Overview

CodeSecure offers two main support offerings focused on assisting customers improving their software quality, security and safety. Different customers have different needs in their software development lifecycle and the two-support offering aims to provide flexibility. Standard support is aimed at software development teams for which static analysis is important, but not critical, while the premium support is aimed at teams in which static analysis is a key part of the release cycle and hence dedicated Service Level Agreements (SLAs) are key to support the business.

A PDF data sheet of all offerings can be found here.

Standard Support 

• Professional support Monday-Friday, 9am to 6pm ET  (Eastern US Timezone)
  
• Targeted response from Developer Support Engineers via Phone, Email, or Web 
• Self-Help providing instance access to solutions via the Support Portal 
• New product releases, defect fixes, and workarounds 

Premium Support  

Includes everything in Standard Support, plus:  

• Comprehensive support 24 hours a day, 7 days a week for high impact issues 
• Faster Initial Response with dedicated phone line
  
• Dedicated Support Engineer 
• Assistance with Custom Configurations 
• Priority Ticket Handling 

Premium Details

Dedicated Support Engineer 

Handled by specialist engineers who built up knowledge and have familiarity with customer environments and can resolve premium tickets expeditiously.  Engineers will ensure pending actions are acted on in a timely manner, inspected regularly with an eye toward timely resolution and QBRs to discuss overall product usage and ticket submission.  

Assistance with Custom Configurations 

Will provide technical guidance and oversight for specific configurations involving custom checkers, custom compiler models, third-party integration that all contribute to work effort in upgrading product versions. Testing and enhancing custom workflows will be assessed to ensure performance impact is kept to a minimum. Best practices for all custom models will be discussed to ensure there is momentum towards moving to non-custom models, allowing for easier migration when upgrading.  

Priority Ticket Handling 

Tickets are handled by support engineers who work quickly to resolve issues that are related to product defects and where high impact situations arise that need escalating. Engineers will work closely with other teams to prioritize work and to find solutions. Where required workarounds/patches will be released ahead of schedule so timelines can be met. 

Faster Initial Response 

Tickets will be responded above the threshold set for standard support customers. The definitions defined for impact (severity) are listed below and initial response times based on impact for premier customers will be reduced, see article for target times. Dedicated phone number to ensure you receive quick support on urgent issues.

The following tables show the present supported versions for CodeSonar and CodeSentry. This article also provides clarification on how support is defined as well as what is included in different versions.

Version Changes: X.Y

• X: major release
  • Significant new functionality added (or integrations)
• Y: minor release
  • Enhanced and/or new functionality
• Z: patch release
  • Release that contains patches, bug fixes, and very minor enhancements

LifeCycle

• Active: current release and two versions thereafter 
• Sunset: products that fall outside active which detail the following:
  
  • No enhancements, only Critical/Urgent defects fixed
  • Start EOL window, which lasts 12 months
• End of Life (EOL): No fixes will be made available; installers are available if required and there is no end-of-life support

CodeSonar

CodeSentry

Standalone CodeSonar for Java and C#

This video demonstrates what CodeSecure can do to protect your code and help build out strength and depth against threats connected to code used in application across many different types of industries.

Overview

This article provides information on what support is given to host platform, languages and compilers. The information listed below can be found in the manual by searching for the keyword 'System Requirements' which then will result in other topics being linked thereafter.

Platform Support

It is important to note the the following when running CodeSonar for Java/C# analysis:

• CodeSonar Java analysis is available on 64-bit Windows and Linux only.
• CodeSonar C# analysis is available on 64-bit Windows only, and requires .NET Framework 4.7.2 or later.

Language Support

Tier 3: all other languages

Go, JavaScript and TypeScript, Kotlin, Python, Rust

Analysis for tier 3 source languages is provided through integration with third-party analyzers.

We provide general instructions for integrating SARIF results from any analyzer with your CodeSonar project. We also provide tool-specific instructions for a select number of third-party analyzers. Some of these are shipped with CodeSonar and some are not.

Shipped with CodeSonar.

Note that if you are already using one of these tools in your organization, we recommend using your own installed version rather than the one shipped with CodeSonar.

• Kotlin

Not shipped with CodeSonar. See the following section for more information.

• Clang Static Analyzer
• ESLint, typescript-eslint, SARIF formatter for ESLint
• Pylint
• Rust Clippy; Rust Clippy-Sarif
• Staticcheck

Third-Party Tools Not Shipped with CodeSonar

CodeSonar provides a number of integrations with external third-party software: software that is neither part of CodeSonar nor shipped with CodeSonar.

• In order to use these integrations, the relevant software must be available on your local system. If it is not already available, you will need to install and configure the software.
• These software packages are supported by their respective manufacturers.

See the manual for more information.

Compiler Support

CodeSonar comes with a number of pre-installed compiler and compiler driver models and is expected to be compatible with widely-used versions of these compilers. Other compilers not on this list can be accommodated either through the generic compiler, or with the custom compiler accompanied with some scripting. 

It is important to note that an object-code compiler is represented in CodeSonar by a compiler model.

Supported without Compiler Models

(Windows Only) CodeSonar provides special handling for builds with CodeWarrior installations that use DLLs:

DLL Approach (Windows only)

If your CodeWarrior installation uses DLLs, you will need to install CodeSonar DLLs for CodeWarrior so that CodeSonar can capture full information about your software build. 

Standard Approach

If your CodeWarrior installation uses compiler executables rather than DLLs, you don't need to install any additional components. Observed compiler invocations will be recognized and mapped to Compiler Support (Pre-installed Compiler/Driver Models) using exactly the same mechanisms as are used for other tools.

There are currently three pre-installed CodeWarrior compiler models:

• chc12: Freescale CodeWarrior for HC12 compiler model
• mwccarm: Freescale CodeWarrior for Embedded ARM compiler
• mwccmcf: Freescale CodeWarrior for ColdFire compiler model

Custom Compiler Models

CodeSonar ships with compiler models for many industry standard compilers. In cases where none of these models are suitable, a custom compiler model may be required.

Compiler models can be authored in C++ or Python and if you are a premium support customer you may leverage tailored support to help build out custom compiler models to fit your software project requirements. 

Note: STk compiler models are no longer supported. If you have previously implemented a custom STk compiler model and need assistance converting it to C++ or Python, please submit a support ticket where advice may be given on potential next steps. 

Overview

CodeSentry is built as a SaaS hosted solution but can be installed locally within your own domain if required. The on-premise installation uses Replicated and consequently the operating system and hardware requirements for CodeSentry are closely related to those for Replicated as described below. 

This information is applicable to all versions of CodeSentry that are supported via our product matrix.

Platform Support

It is important to note that CodeSentry can only be installed on Linux systems.

Hardware

Hardware requirements are specific to the workload running in the cluster but the following guidelines are recommended to support bare cluster installations.

Primary:

• Memory - recommended: 132GB, minimum: 100GB
• CPU - Intel Xeon® Platinum 8175M processors with Advanced Vector Extension (AVX-512) instruction set (or better).
  
  • Cores - recommended: 46 virtual cores, minimum: 38 virtual cores
• Disk - High-IOPS, low latency disks are required (SSD, non-NFS) - 4.5TB
  

Node:

• Memory - recommended: 96GB, minimum: 32GB
• CPU - recommended 16 virtual cores, minimum: 8 virtual cores
• Disk - 1.5TB

Performance

Typical performance, noted as number of targets scanned per hour, is calculated by scanning a variety of typical software packages. CodeSentry is capable of the following performance, depending upon hardware settings.

Installer Files

Ports Used

Supported File Formats

* = Zero-day analysis of a .o file will complete with scan status of "Done" but no findings will be detected.

Operating System and Package Detection (Windows) supports analysis of Windows registry hive and Windows UWP/AppX package manifest files.

NOTE: The registry files that operating system analyzer supports are those named SOFTWARE that appear in a System32/config directory, and NTUSER.DAT

Supported Firmware Formats

The following formats are supported

• File Formats
  • SREC
  • bFLT
  • base64
  • Intel HEX
  • uBoot
  • wim
• File Systems
  • JFFS2 (.img and .jffs2)
  • romfs
  • yaffs2
  • ubifs

Other Information

The following addition information can be found in the CodeSentry datasheet

• Software Bill of Materials (SBOM) Output
• Vulnerabilities and Checks Performed
• Security Attributes

In today’s connected economy, more and more systems are controlled by software-based systems. These systems provide functions ranging from basic to highly sophisticated, from applications such as basic servo actuation in a public water delivery system to crash avoidance systems in the latest generation of automobiles to robotic surgery systems.

Given these increased needs, demands, and their associated safety and security requirements, many industry vertical applications have created development best practices, guidelines, and certification processes. Today, several secure coding standards have been adopted by various industries, including the following: DO-178B/C (Aerospace), IEC 61508 and IEC 62443 (Industry / Energy), ISO 26262 (Automotive), and IEC 62304 (Medical).

Central to each of these secure coding standards is the security, risk, and safety of software. The risk is a function of frequency (or likelihood) of the hazardous event and the event consequence severity. The risk is reduced to a tolerable level by applying secure coding best practices, the elimination of defects/warnings that can increase likelihood, and safety functions which may consist of E/E/PES and/or other technologies.

Static analysis is a crucial capability in supporting all standards. Static analysis simplifies the enforcement of coding standards across teams, improving the overall compliance for a required certification standard and quality of the code. CodeSecure helps teams:

CodeSecure’s Software Certification solution helps your team meet the most rigorous safety and security requirements.

Overview

CodeSecure's adoption acceleration services are aimed at enhancing the customer experience via advanced on-boarding, training and consulting. This will enable customers to quickly see value from our static code or software composition analysis solutions. Our team of experts will help integrate with existing build processes and identify vulnerabilities enabling safe and reliable code to be delivered to your customers.

Through our training and mentoring channels we allow your team to quickly get up to speed and to effectively rollout our CodeSonar or CodeSentry offerings through instructor-led sessions. If you are looking for customization or optimization, let our experts help you integrate our products into your DevSecOps pipeline or take advantage of our rich APIs that can help you stay connected to other tooling within your software development lifecycle. 

Advanced On-Boarding

Training

Consulting

For any inquiries please email us at services@codesecure.com or for more information click here.

If you need to review our professional services agreement it can be found here.

Overview

This articles details what videos are available on our CodeSecure YouTube channel. Links are provided below and a brief summary of what the video entails.

Overview

This articles details what videos are available on our CodeSecure YouTube channel. Links are provided below and a brief summary of what the video entails.