application-inspector

What this skill does

# Microsoft Application Inspector

## When to Use Application Inspector

**Ideal scenarios:**

- Technology stack profiling and discovery
- Identifying security-relevant code patterns (authentication, cryptography, logging)
- Pre-audit reconnaissance to understand codebase capabilities
- Detecting use of sensitive APIs and security controls
- Creating software composition reports
- Finding data handling patterns (PII, credentials, encryption)

**Complements other tools:**

- Use before Semgrep/CodeQL for context on what security patterns exist
- Combine with SARIF Issue Reporter for detailed findings analysis
- Use alongside SCA tools to understand both dependencies and implementation

## When NOT to Use

Do NOT use this skill for:

- Finding specific vulnerabilities (use Semgrep, CodeQL, or SAST tools)
- Dependency vulnerability scanning (use OSV-Scanner or Depscan)
- Secrets detection (use Gitleaks)
- IaC security analysis (use KICS)
- Deep data flow analysis

## Installation

```bash
# .NET tool (recommended)
dotnet tool install --global Microsoft.CST.ApplicationInspector.CLI

# Update
dotnet tool update --global Microsoft.CST.ApplicationInspector.CLI

# Verify
appinspector --version

# Docker
docker pull mcr.microsoft.com/app-inspector
docker run -v ${PWD}:/app mcr.microsoft.com/app-inspector analyze -s /app -f sarif -o /app/results.sarif
```

## Core Workflow

### 1. Quick Analysis

```bash
# Analyze directory with default rules
appinspector analyze -s /path/to/code -f html -o report.html

# Text summary
appinspector analyze -s /path/to/code -f text

# JSON output
appinspector analyze -s /path/to/code -f json -o results.json
```

### 2. SARIF Output

```bash
# Generate SARIF report
appinspector analyze -s /path/to/code \
  --output-file-format sarif \
  --output-file-path results.sarif

# With custom rules
appinspector analyze -s /path/to/code \
  -r /path/to/custom-rules \
  --output-file-format sarif \
  --output-file-path results.sarif

# Single-threaded for stability
appinspector analyze -s /path/to/code \
  --single-threaded \
  --file-timeout 500000 \
  --output-file-format sarif \
  --output-file-path results.sarif
```

### 3. Security-Focused Analysis

```bash
# Focus on security features
appinspector analyze -s /path/to/code \
  -t "Authentication,Cryptography,Authorization" \
  -f json -o security-features.json

# Exclude test files
appinspector analyze -s /path/to/code \
  -e "test,tests,spec,__pycache__" \
  -f sarif -o results.sarif
```

## Understanding Output

### Tag Categories

Application Inspector detects patterns across categories:

| Category | Examples |
|----------|----------|
| **Authentication** | OAuth, JWT, Session management, Password handling |
| **Cryptography** | AES, RSA, Hashing, Key derivation, Random generation |
| **Authorization** | RBAC, ACL, Permission checks, Policy enforcement |
| **Data.PII** | Email, SSN, Credit card, Phone numbers |
| **Data.Credentials** | API keys, Passwords, Tokens, Certificates |
| **CloudServices** | AWS, Azure, GCP API usage |
| **Framework** | Express, Django, Spring, ASP.NET |
| **Database** | SQL, NoSQL, ORM usage |

### Severity Levels

- **Critical**: High-risk patterns (hardcoded secrets, weak crypto)
- **Important**: Security-relevant code requiring review
- **Moderate**: Potentially sensitive functionality
- **ManualReview**: Patterns requiring human analysis
- **BestPractice**: Recommended patterns found

## Custom Rules

### Rule Structure

```json
{
  "name": "Detect hardcoded API keys",
  "id": "DS123456",
  "description": "Identifies potential hardcoded API keys",
  "tags": [
    "Data.Credentials.APIKey"
  ],
  "severity": "Critical",
  "patterns": [
    {
      "pattern": "api[_-]?key\\s*=\\s*['\"][a-zA-Z0-9]{20,}['\"]",
      "type": "regex",
      "confidence": "High",
      "scopes": [
        "code"
      ]
    }
  ]
}
```

### Rule File Format

Create `custom-rules.json`:

```json
[
  {
    "name": "AWS Access Key",
    "id": "DS001",
    "tags": ["Data.Credentials.AWS"],
    "severity": "Critical",
    "patterns": [
      {
        "pattern": "AKIA[0-9A-Z]{16}",
        "type": "regex",
        "confidence": "High"
      }
    ]
  }
]
```

Use with:

```bash
appinspector analyze -s /code -r custom-rules.json -f sarif -o results.sarif
```

## Verification Commands

```bash
# Verify rules
appinspector verify-rules -r /path/to/rules

# Test specific rule
appinspector verify-rules -r custom-rules.json

# List default rules
appinspector exportrules -o default-rules.json
```

## CI/CD Integration (GitHub Actions)

```yaml
name: Application Inspector

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '0 0 1 * *'

jobs:
  analyze:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0'

      - name: Install Application Inspector
        run: dotnet tool install --global Microsoft.CST.ApplicationInspector.CLI

      - name: Run Analysis
        run: |
          appinspector analyze \
            -s ${{ github.workspace }} \
            --output-file-format sarif \
            --output-file-path results.sarif \
            --single-threaded \
            --disable-archive-crawling

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif
          category: application-inspector

      - name: Upload Results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: application-inspector-results
          path: results.sarif
```

## Configuration

### Performance Options

```bash
# Single-threaded (more stable)
appinspector analyze -s /code --single-threaded

# Increase timeout for large files
appinspector analyze -s /code --file-timeout 500000

# Disable archive scanning (faster)
appinspector analyze -s /code --disable-archive-crawling

# Process only specific languages
appinspector analyze -s /code -l "javascript,typescript,python"
```

### Exclusions

```bash
# Exclude paths
appinspector analyze -s /code \
  -e "node_modules,vendor,dist,build,__pycache__"

# Exclude file patterns
appinspector analyze -s /code \
  -e "*.min.js,*.test.js,*.spec.ts"
```

## Common Use Cases

### 1. Pre-Audit Technology Discovery

```bash
# Generate comprehensive technology report
appinspector analyze -s /code -f html -o tech-report.html

# Review report to understand:
# - What frameworks are used
# - What crypto libraries are present
# - How authentication is implemented
# - What cloud services are integrated
```

### 2. Security Feature Inventory

```bash
# Find all security-relevant patterns
appinspector analyze -s /code \
  -t "Authentication,Authorization,Cryptography,Data.Credentials" \
  -f json -o security-inventory.json
```

### 3. Compliance Scanning

```bash
# Detect PII handling
appinspector analyze -s /code \
  -t "Data.PII" \
  -f sarif -o pii-report.sarif

# Find credential usage
appinspector analyze -s /code \
  -t "Data.Credentials" \
  -f sarif -o credentials-report.sarif
```

## Interpreting Results

### SARIF Structure

Application Inspector SARIF includes:

- **Rules**: Each detected pattern/tag
- **Results**: Specific code locations matching patterns
- **Properties**: Confidence, severity, tags
- **Locations**: File path, line number, code snippet

### Filter by Severity

```bash
# Use SARIF tools to filter
pip install sarif-tools

# Extract critical findings only
sarif summary results.sarif --level error

# Filter by tag
sarif filter --level error --rule-id "DS.*Credentials.*" results.sarif
```

## Limitations

- **Not a vulnerability scanner**: Identifies patterns, not exploits
- **False positives**: Regex-based detection can flag legitimate code
- **Performance**: Large codebases may require single-threaded mode
- **Language coverage**: Better for common languages (JS, Python, C#, Java)
- **No data flow**: Ca