User Manual ยท Operational Guide

Set up AquilaX
for your team.

An 8-step guide to configuring AquilaX to scan all your repositories โ€” from group structure and security policy through CI/CD integration and ongoing review workflows.

Start Free Trial โ†’ Full Docs
1 Organise Your Groups

Create Your Default Group

Start by creating a single Default Group in AquilaX. This centralises management of all your repositories under one security policy and one dashboard view โ€” reducing configuration overhead and ensuring consistent scanning across your entire codebase.

Navigate to Dashboard โ†’ Groups โ†’ Create Group. Give it a meaningful name (e.g. "Production", "Client-A", or "Platform Team"). All repositories added to this group will automatically inherit the group's security policy.

Tip: Use one group per client or product line if you have distinct codebases with different security requirements. All repos within a group share the same scanner configuration and severity thresholds.

2 Clean Up Projects

Remove Pre-Existing Projects

Before adding your production repositories, delete any automatically imported demo projects or test repositories. Pre-existing projects with misconfigured settings will skew your group's Security Rating and produce noise in your findings dashboard.

Go to Group โ†’ Projects, select any unwanted projects, and remove them. Then add your real repositories one by one or via bulk import from your connected GitHub or GitLab organisation.

3 Configure Security Policy

Define Your Security Policy

AquilaX uses a JSON-based security policy applied uniformly to all repositories in a group. Configure which scanners are enabled, severity thresholds, ignore patterns, and licence detection rules โ€” once, for the entire group.

Example Security Policy

// AquilaX Security Policy โ€” applied at group level { "scanners": { "compliance": true, "secrets": true, "pii": true, "sast": true, "sca": true, "sca_license": true, "container": true, "iac": true, "api": true, "malware": true }, "thresholds": { "high": 50, "medium": 1000, "low": 99999, "total": 300 }, "ignore_patterns": [ "test/*", "tests/*", "node_modules/*", "semgrep-rules/**", "yara_rules/**", "configs/**" ], "license_detection": { "mixed": true, "prohibited": ["GPL*", "AGPL*"] } }

Threshold Guidance

SeverityDefault LimitWhen to Lower
HIGH50Compliance environments โ€” consider 10
MEDIUM1,000Mature codebases with low debt
LOW99,999Rarely needs changing
Total combined300Adjust based on codebase size
4 CI/CD Integration

Connect to GitHub / GitLab

AquilaX integrates natively with GitHub and GitLab. Once connected, every pull request and push triggers a full scan automatically โ€” results appear in the PR before merge, with a Security Rating delta showing whether the change improved or worsened posture.

PlatformIntegration TypeSetup Location
GitHubGitHub App + ActionsSettings โ†’ Integrations โ†’ GitHub
GitLabGitLab CI/CD nativeSettings โ†’ Integrations โ†’ GitLab
BitbucketWebhook + REST APISettings โ†’ Integrations โ†’ Webhook
JIRAAutomated ticket creationSettings โ†’ Ticketing โ†’ JIRA

JIRA Integration: Configure automated ticket creation with custom title and body templates. Findings above your HIGH threshold automatically open JIRA tickets assigned to the relevant team.

5 Schedule Scans

Schedule Periodic Full Scans

CI/CD scans only fire when code changes. New CVEs are published daily โ€” your dependencies may become vulnerable without a single line of code changing. Scheduled full-repository scans catch this drift.

Go to Group โ†’ Scan Schedule and configure a recurring scan. The recommended cadence is weekly, run during off-peak hours to avoid resource contention with your CI/CD pipeline.

Recommended: Weekly full scan on Sunday 02:00 UTC. This catches new CVEs published since the last code push and ensures your Security Rating reflects current exposure, not just last deployment state.

6 Review Findings

Engage AquilaX for Findings Review

Raw scan results contain three finding states. Understanding each state is key to effective triage and driving down your false positive rate over time.

StateMeaningAction
ConfirmedSecuritron AI has verified this as a real, exploitable vulnerabilityFix immediately โ€” auto-fix PR available
UnverifiedScanner flagged it; AI has not yet classified itReview manually or request AquilaX triage
InformationalLow risk, context-dependent โ€” unlikely to be exploitableMonitor; suppress if not applicable

Ultimate Licence: AquilaX security engineers review Unverified findings and classify them. Each triage action trains your custom Securitron model โ€” reducing false positives continuously over time.

7 Monitor Reports

Monitor Reports & Alerts

AquilaX provides real-time dashboards and scheduled email summaries. Configure weekly report delivery to security leads and engineering managers for continuous visibility without requiring manual log-ins.

Navigate to Dashboard โ†’ Reports โ†’ Schedule. Configure recipients, frequency, and report scope (per-repo or group-wide). Reports include Security Rating trend, new findings since last report, and resolved items.

Tip: Send weekly reports to both the engineering lead and the CISO. The Security Rating trend is the single most useful metric for executive-level reporting โ€” no security jargon required.

8 Testing Sandbox (Optional)

Create a Testing Sandbox

For teams experimenting with new frameworks, third-party integrations, or experimental branches, a separate Testing Group isolates security noise from production metrics without affecting your main Security Rating.

Create a second group named "Testing" or "Sandbox". Apply a relaxed security policy (higher thresholds, fewer scanners) and add experimental repositories there. This lets developers explore without triggering alerts in the production dashboard.

โšก Quick Reference

Common Actions

Quick navigation to the most frequently used settings in the AquilaX dashboard.

ActionDashboard Path
Create a groupDashboard โ†’ Groups โ†’ Create Group
Add a repositoryGroup โ†’ Add Project
Set security policyGroup โ†’ Security Policy
Connect GitHub/GitLabSettings โ†’ Integrations
Schedule a scanGroup โ†’ Scan Schedule
View findingsDashboard โ†’ Findings
View Security RatingDashboard โ†’ Security Rating
Configure email reportsDashboard โ†’ Reports โ†’ Schedule
Configure JIRA ticketsSettings โ†’ Ticketing โ†’ JIRA
Apply licence keySettings โ†’ Licence
Get scanning in minutes

Your first scan runs
in 90 seconds.

Connect your GitHub or GitLab repository, apply the default security policy, and AquilaX takes care of the rest โ€” automatically, on every push.

Start Free Trial โ†’ Book a Demo
14-day Ultimate trial No credit card required Cancel anytime On-premises available