Using Blue Sentinel

Overview

Blue Sentinel is a self-hosted platform for static application security testing (SAST) and software composition analysis (SCA). You point it at a source-code project and it runs multiple analysis engines across every supported language, detects vulnerable dependencies, and produces prioritized, standards-mapped findings and reports.

It runs in three modes: on-premises on your local network, fully air-gapped with no outbound connectivity, or via Claude for an AI-assisted workflow. In on-prem and air-gapped modes your source code never leaves your environment.

Deploy with Docker

Blue Sentinel ships as a single Docker image. On your host:

# Load the image you were provided
docker load -i bluesentinel-image.tar

# Run it
docker run -d --name bluesentinel \
  -p 8443:8443 \
  -v bluesentinel-data:/app/data \
  sast-platform:latest

# The web UI is now reachable on your network:
#   https://<host-ip>:8443

First login

Open the UI in a browser, sign in with the administrator credentials supplied with your deployment, and create accounts for your team. Blue Sentinel uses role-based access control — assign Admin, User, or Viewer roles as appropriate.

Prepare your code

A scan takes a zip of your project. To keep uploads lean and focused on code, use the bundled Code_extractor tool to strip images, PDFs, documents, and build output while keeping source files and dependency manifests:

./Code_extractor ./my-app my-app-code.zip

It also writes a Project_Info.txt summarizing file counts, lines of code, and a breakdown by file type. Upload the resulting zip in the next step.

Run a scan

1. Open the Scan Wizard and upload your project zip.
2. Choose a scan depth — deeper scans enable full data-flow, taint, and dependency analysis.
3. Select the security standards to map against (OWASP Top 10, SANS/CWE Top 25).
4. Confirm the analysis options — software composition analysis, secrets, and license checks can be toggled.
5. Start the scan and watch progress in real time.

Understand results

When the scan finishes you land on the results page:

• Overview — severity totals, an SCA summary, and quick actions.
• Findings — a severity-first, filterable list. Each row shows the finding, location, CWE, and status.
• Finding detail — open any finding for its description, technical analysis, taint path, code snippet, and remediation.
• Attack Surface Map — a visual graph of how untrusted input reaches dangerous sinks.
• AI Triage — let the assistant propose likely false positives for your approval; nothing changes without review.

Composition analysis

When enabled, Blue Sentinel parses your dependency manifests (package.json, requirements.txt, go.mod, composer.json, pom.xml, and more), matches each package against a vulnerability database, and reports known-vulnerable components with severities and fix versions. Open SCA Results from the report header to see the full breakdown by ecosystem, and export it as JSON, PDF, or CSV.

Compare external reports

Already run Burp, Snyk, OWASP ZAP, or Acunetix? Upload their report and Blue Sentinel compares it against your SAST scan:

• Confirmed — findings both tools agree on.
• SAST only — issues your scan caught that the external tool missed.
• External only — issues the other tool caught that your scan missed — review these first.

A coverage score shows how much of the external tool's findings your SAST also caught. Use See external report to browse the full imported findings — description, affected parameter, remediation, and references.

Risk Overview

From an assessment, open Risk Overview for six decision-making views over your findings — each downloadable as CSV, JSON, or PNG:

• Fix Location Heatmap — a treemap of the codebase; files sized by lines of code, coloured by worst severity. Surfaces "fix the root once" hotspots.
• Prioritization Matrix — every finding plotted by exploitability × business impact; the top-right quadrant is your fix-now list. Click a quadrant to list its files and findings.
• Best Fix Locations — the highest-leverage remediation points ("fix N findings by changing 1 line here"), ranked, with a suggested fix type.
• Dependency Graph — Project → ecosystem → package; node size = number of CVEs, colour = worst severity. Click a package for its CVEs and fix version.
• Trend — open findings by severity over successive assessments, plus added-vs-removed per scan and week-over-week metric cards.
• OWASP Radar — coverage across the OWASP Top 10 (2021), overlaid on the previous assessment, with a configurable risk threshold.

Deployment architecture

Every assessment runs in its own dedicated, isolated cloud environment — created for your scan and destroyed when it's done. Blue Sentinel is available on the AWS and Azure marketplaces; your code never touches shared infrastructure.

Open the full architecture diagram ↗

Export reports

From a scan, use Generate Report to export findings as CSV, XML, or JSON, or produce a PDF in one of three depths:

• Light — cover, executive summary, and findings index. For stakeholders and triage.
• Standard — everything in Light plus per-finding detail: description, classification, and remediation.
• Detailed — everything in Standard plus code snippets, taint path, call chain, and data flow.

Troubleshooting

• No SCA results? Make sure your uploaded zip includes the dependency manifests (they're kept by Code_extractor).
• Scan is slow on large projects? Choose a lighter scan depth, or scan sub-projects separately.
• Need engine details? The report header flags any engine that did not contribute results and why.