Documentation Nexus IQ Server 1.22

Our documentation site has moved. For the most current version, please see

Nexus IQ Server Documentation


Sonatype, Inc. Bruce Mayhew Manfred Moser Kelly Robinson Ann Rollo Jeff Wayman Justin Young

1. How to Use This Book
3. Requirements
3.1. Nexus Solutions
3.2. Installation Requirements
3.2.1. IQ Server
3.2.2. IQ Server Web Application
3.2.3. REST API Versioning
3.2.4. Nexus IQ CLI
3.2.5. Sonatype CLM for Eclipse Requirements
3.2.6. IQ for IDEA Requirements
3.2.7. Nexus IQ for Bamboo Requirements
3.2.8. Sonatype CLM for Hudson / Jenkins Requirements
3.2.9. Sonatype CLM for Maven Requirements
3.2.10. Sonatype CLM for Nexus Pro Requirements
3.2.11. Sonatype CLM for SonarQube Requirements
4. Quick Start Guide for Nexus IQ Server
5. IQ Server Setup
5.1. Installation
5.1.1. Starting the IQ Server
5.1.2. License Installation
5.1.3. IQ Server Directories
5.1.4. Running the IQ Server as a Service
5.2. Advanced Configuration
5.2.1. Initial Configuration of the IQ Server
5.2.2. Running the IQ Server Behind a HTTP Proxy Server
5.2.3. Setting the Base URL
5.2.4. Reverse Proxy Authentication
5.2.5. Appending a User Agent String
5.2.6. File Configuration
5.2.7. Email Configuration
5.2.8. Logging Configuration
5.2.9. HTTP Configuration
5.2.10. HTTPS/SSL
5.2.11. Anonymous Access
5.2.12. CSRF Protection
5.3. Backing Up the IQ Server
5.4. Upgrading the IQ Server
5.4.1. Upgrading from Version 1.17 or Earlier to Version 1.18 or Later
5.4.2. Upgrading from Version 1.16 or Earlier
5.4.3. Upgrading from Versions Earlier than 1.9.x
6. Security Administration
6.1. Logging In
6.2. Product Notifications
6.3. User Management
6.3.1. Changing the Admin Account Password
6.3.2. Creating a User
6.3.3. Editing and Deleting User Information
6.4. LDAP Integration
6.4.1. Configuring the LDAP Server Connection
6.4.2. LDAP Configuration Parameters
6.4.3. Mapping LDAP Users
6.4.4. LDAP User Parameters
6.4.5. Mapping LDAP Groups
6.4.6. LDAP Group Parameters
Static Groups
Dynamic Groups
6.4.7. Verifying LDAP Configuration
Test Connection
Check User and Group Mapping
Check Login
6.5. Role Management
6.5.1. Viewing Built-in Roles
6.5.2. Viewing Permissions of Built-in Roles
6.5.3. Understanding the Importance of Hierarchy
6.5.4. Managing Administrator Roles
Viewing Administrator Roles
Assigning Users to Administrator Roles
6.5.5. Managing Organizational Roles
Viewing Organizational Role Assignments
Assigning Users to Organizational Roles
Editing Organizational Role Assignments
Removing Organizational Role Assignments
6.5.6. Creating Custom Roles
6.5.7. Assigning Groups to Roles without Searching
6.5.8. Viewing Role Assignments
7. Organization and Application Management
7.1. Hierarchy
7.2. Inheritance
7.3. Applications, Evaluations, and Reports
7.4. The Root Organization
7.4.1. Configuring the Root Organization
7.4.2. Creating the Root Organization
7.5. Viewing the Root Organization
7.6. Creating an Organization
7.7. Editing an Organization
7.8. Deleting an Organization
7.9. Creating an Application
7.10. Editing an Application
7.10.1. Selecting an Application Contact
7.10.2. Removing an Application Contact
7.10.3. Copying the Application ID to Clipboard
7.10.4. Changing an Application ID
7.11. Moving an Application
7.12. Deleting an Application
7.13. Viewing Organizations and Applications
7.14. Managing Organizations and Applications
8. Basic Policy Management
8.1. What is a Policy?
8.2. Getting Started with Policies
8.2.1. Downloading the Sample Policy Set
8.2.2. Importing Policies
8.3. Viewing Policies
8.4. Creating Policies
8.5. Editing Policies
8.6. Deleting Policies
8.7. Understanding the Parts of a Policy
8.7.1. Policy Name
8.7.2. Threat Level
8.7.3. Inheritance
8.7.4. Constraints and Conditions
8.7.5. Actions
8.7.6. Notifications
8.8. Continuous Monitoring of Applications
8.9. Proprietary Component Configuration
9. Advanced Policy Management (Component Labels, License Threat Groups, and Application Categories)
9.1. Component Labels
9.1.1. Viewing a Component Label
9.1.2. Creating a Component Label
9.1.3. Editing a Component Label
9.1.4. Deleting a Component Label
9.2. License Threat Groups
9.2.1. Viewing a License Threat Group
9.2.2. Creating a License Threat Group
9.2.3. Editing a License Threat Group
9.2.4. Deleting a License Threat Group
9.3. Application Categories
9.3.1. Creating Application Categories
9.3.2. Editing an Application Category
9.3.3. Deleting an Application Category
9.3.4. Assigning an Application Category
9.4. Manual Application Evaluation
10. The Dashboard
10.1. Using the Dashboard
10.1.1. Filters
10.1.2. Dashboard Header
10.2. Highest Risk Violations
10.2.1. Newest
10.2.2. By Component
10.2.3. By Application
10.3. Viewing Component Details
11. The Application Composition Report
11.1. Accessing an Application Composition Report
11.2. Reviewing a Report
11.2.1. Summary Tab
11.2.2. Policy Violations Tab
11.2.3. Security Issues Tab
11.2.4. License Analysis Tab
11.3. Printing and Reevaluating the Report
11.4. The Component Information Panel (CIP)
11.5. Resolving Security Issues
11.5.1. Security Issues
11.5.2. The Component Information Panel (CIP)
11.5.3. Editing Vulnerability Status
11.5.4. Matching to Violations
11.6. License Analysis Tab
11.6.1. License Threat Group
11.6.2. License Analysis
11.6.3. The Component Information Panel (CIP)
11.6.4. Editing License Status and Information
11.7. Component Identification
11.7.1. Matching Components
11.7.2. Managing Proprietary Components
11.7.3. Claiming a Component
11.8. Component Label Overview
11.8.1. Where do component labels begin?
11.8.2. Assigning a Label
11.9. Waivers
11.9.1. A Use Case for Waivers
11.9.2. Adding a Waiver
11.9.3. Viewing and Removing a Waiver
11.10. Policy Reevaluation
11.11. PDF Report
11.11.1. Creating the PDF
11.11.2. Reviewing the PDF
12. Sonatype CLM and Repository Management
13. IQ for Nexus Repository Manager
13.1. Integrating Nexus Repository Manager 2.x and IQ Server
13.1.1. Connecting to IQ Server
13.1.2. Viewing Component Information
13.1.3. Component Details
13.1.4. Using Staging to Control Releases
Staging Profile Configuration
Policy Actions for Staging
Policy Actions for Release Repositories
13.1.5. Using Audit and Quarantine
Configuring Audit and Quarantine
Disabling Audit and/or Quarantine
Releasing a Component from Quarantine
Re-enabling Audit and/or Quarantine
Viewing Repository Results
Using the Component Information Panel (CIP)
Waiving Repository Policy Violations
13.1.6. Managing Repositories
13.1.7. Managing User Roles
13.1.8. Removing a Repository in IQ Server
14. Sonatype CLM and Continuous Integration
15. Nexus IQ for Bamboo
15.1. Install Nexus IQ for Bamboo
15.2. Configure Nexus IQ for Bamboo
15.3. Adding the IQ Analysis Task
15.4. Reviewing IQ Policy Results
16. IQ for Hudson/Jenkins
16.1. Installation
16.2. Global Configuration
16.3. Job Configuration
16.4. Inspecting Results
17. Sonatype CLM and IDEs
18. Sonatype CLM for Eclipse
18.1. Installing Sonatype CLM for Eclipse
18.2. Configuring Sonatype CLM for Eclipse
18.3. Using the Component Info View
18.4. Filtering the Component List
18.5. Searching for Component Usages
18.6. Inspecting Component Details
18.7. Migrating to Different Component Versions
19. IQ for IDEA
19.1. Installing IQ for IDEA
19.2. Configuring IQ for IDEA
19.3. Using the Component Info View
20. Sonatype CLM for SonarQube
20.1. Installation
20.2. Configuration
20.3. Proxy Configuration
20.4. Select the CLM Application
20.5. Add and Configure the Sonatype CLM Widget
20.6. Accessing the Application Composition Report
21. Nexus IQ CLI
21.1. Downloading the Nexus IQ CLI
21.2. Locating Your Application Identifier
21.3. Evaluating an Application
21.3.1. Additional Options
21.4. Example Evaluation
21.5. Using the Nexus IQ CLI with a CI Server
22. Sonatype CLM for Maven
22.1. Evaluating Project Components with Sonatype CLM Server
22.1.1. Authentication
22.1.2. Simplifying Command Line Invocations
22.1.3. Skipping Executions
22.2. Creating a Component Index
22.2.1. Excluding Module Information Files in Continuous Integration Tools
22.3. Creating a Component Info Archive for Nexus Pro CLM Edition
22.4. Using Sonatype CLM for Maven with Other IDEs
22.4.1. Maven Plugin Setup
22.4.2. IntelliJ IDEA
22.4.3. NetBeans IDE
23.1. Component Search REST APIs (v2)
23.2. Component Details API (v2)
23.3. Component Evaluation REST APIs (v2)
23.4. Application REST APIs (v2)
23.5. Violation REST API (v2)
23.6. Report-related REST APIs (v2)
A. Copyright