SonarQube is a code quality and vulnerability solution for development teams that integrates with CI/CD pipelines to ensure the software you produce is secure, reliable, and maintainable.
$160
per year per installation
Trend Micro Cloud App Security
Score 8.7 out of 10
N/A
The Trend Micro Cloud App Security application secures Microsoft Office 365 and other cloud storage applications.
SonarQube is excellent if you start using it at the beginning when developing a new system, in this situation you will be able to fix things before they become spread and expensive to correct. It’s a bit less suitable to use on existing code with bad design as it’s usually too expensive to fix everything and only allows you to ensure the situation doesn’t get worse.
The product works great when I have to quarantine a mass email attack. Seems students are always susceptible to email base attacks, we are no different, but when one occurs on a mass email basis I can very easy and quickly block/quarantine those emails either by sender, domain, or URL or all three if need be. We have played with the data loss component but it is hard to do anything but "monitor" because there are way too many false positives. Such as with SSNs and bank routing numbers, but I figure any solution provider would experience the same problem. However, even with monitor and notification only, it is useful to make our users aware they are potentially sending personal information.
Detecting bugs and vulnerabilities: SonarQube can identify a wide range of bugs and vulnerabilities in code, such as null pointer exceptions, SQL injection, and cross-site scripting (XSS) attacks. It uses static analysis to analyze the code and identify potential issues, and it can also integrate with dynamic analysis tools to provide even more detailed analysis.
Measuring code quality: SonarQube can measure a wide range of code quality metrics, such as cyclomatic complexity, duplicated code, and code coverage. This can help teams understand the quality of their code and identify areas that need improvement.
Providing actionable insights: SonarQube provides detailed information about issues in the code, including the file and line number where the issue occurs and the severity of the issue. This makes it easy for developers to understand and address issues in the code.
Integrating with other tools: SonarQube can be integrated with a wide range of development tools and programming languages, such as Git, Maven, and Java. This allows teams to use SonarQube in their existing development workflow and take advantage of its powerful code analysis capabilities.
Managing technical debt: SonarQube provides metrics and insights on the technical debt on the codebase, enabling teams to better prioritize issues to improve the quality of the code.
Compliance with coding standards: SonarQube can check the code against industry standards like OWASP, CWE and more, making sure the code is compliant with security and coding standards.
Importing a new custom quality profile on SonarQube is a bit tricky, it can be made easier
Every second time when we want to rerun the server, we have to restart the whole system, otherwise, the server stops and closes automatically
When we generate a new report a second time and try to access the report, it shows details of the old report only and takes a lot of time to get updated with the details of the new and fresh report generated
Wish I could customize the notification emails more, like including html code to personalize and highlight messages that my end users see when an item is flagged.
Wish there was a word or phrase component to block/flag emails as I can with files, links, senders and domains.
Automation of the BEC list would be a plus...such as pulling in an OU or security group so that I do not have to do manually perform this task.
We have multiple TrendMicro products. Thus it would be nice to have one dash board to "see" or login at least for ApexOne, CAS, etc.
Only a 9 if the product become completely unaffordable. Covid-19 has adversely affected Higher Ed budgets, if that should happen I would lobby hard to find cuts elsewhere...TrendMicro CAS is a necessary tool for any business to have!
Once Cloud App Security is up and running there is no need to do anything additional. The program will begin protecting all the environment immediately and end results are proven. All notifications come to the administrator email to verify and mitigate a response and check the endpoint if necessary. Very easy to use.
We we easily able to integrate the SonarQube steps into our TFS process via the Microsoft Marektplace, we didn't have the need to call SonarQube support. We've used their online documentation and community forum if we ran into any issues.
Trend Micro Cloud App Security’s support has been highly competent and thorough when we have needed their assistance. Their support has been quickly dispatched, both through telephone and Email, while answer our questions and providing the “inside baseball” answers we have wanted when discussing the why and how of certain issues. When it came to implementation, their support sat through us as we deployed agents and took us on an adventure few implementations have.
SonarQube is an open-source. It's a scalable product. The costs for this application, for the kind of job it does, are pretty descent. Pipeline scan is more secured in SonarQube. Its a very good tool and its support multiple languages. Its main core competency is of static code analysis and that is why SonarQube exists and it does it exceedingly well. The quality of scan on code convention, best practices, coding standards, unit test coverage etc makes them one of the best competent tool in the market
To date we had only utilized Symantec Small Business Suite for all of our antivirus needs. We had only moved to the cloud environment during the summer of 2020, and after doing so I'm not sure that I would ever change from Trend Micro Cloud App Security. The cost and features all are a great fit for the small to medium-sized business such as ours.
Positive ROI from the standpoint of flagging several issues that would have otherwise likely been unaddressed and caused more time to be spent closer to launch
Slightly positive ROI from time-saving perspective (it's an automated check which is nice, but depending on the issues it finds, can take developers time to investigate and resolve)
CAS gives us peace of mind knowing the file systems we rely on in the cloud are protected the same way they would be if they were sitting in our office. This leads to a reduced risk of downtime that could otherwise limit us from being able to properly support our customers.
