# Onboarding Applications Best Practices

How you onboard applications will depend on a rough idea of your total inventory of applications.

| No. of Apps | Method                     | Details                                                                                                                                                                                  |
|-------------|----------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| < 50       | Manually onboard            | - Creating an application<br>  <br>- Scanning with the user interface                                                                                                                |
| < 500      | Automatic Application Creation | - Enable automatic application creation<br>  <br>- Adding to ci build<br>  <br>- Command line scanner (CLI)                                                                          |
| > 500      | Onboarding Scripts (REST API) | - IQ Server REST API                                                                                                                                                                   |
| any        | Easy SCM Onboarding         |                                                                                                                                                                                          |
| any        | Config-as-Code project      |                                                                                                                                                                                          |

## Manually Onboard

Add applications using the [Organizations and Applications](https://help.sonatype.com/en/application-management.html "Application Management") menu of the IQ Server user interface (UI).

- Recommended for a limited (<50) number of applications
- Great for testing and pilot teams
- Not an effective long-term strategy
- Common for third-party software and legacy code
- Application ids and names will need to be unique
- Consider using an onboarding script if you already have a complete list

### Potential Pitfalls:

- Manually adding applications can be slow.
- Does not scale.
- Easy to make mistakes:
  - Avoid duplicating application ids when using a build configuration template
  - Noisy notifications and faulty metrics
  - May break remediation waivers

## Automatic Application Creation

Configure the IQ server to allow applications to automatically be added when using an unused PublicID during a scan.

- Applications are automatically added to a default organization.
  - The default organization may be configured in the UI.
- Recommended for applications that would need to be onboarded over time.
- Application Categories will need to be manually set.

### Recommendations:

- Assign someone to review in a holding organization
  - assign Application Categories
  - move to the correct organization
  - rename the applications to something more human-recognizable
- Not recommended for confidential applications.

### Pitfalls:

- Very easy to create new applications unintentionally
- Currently cannot track the scan back to the source
- Only a single default organization
- The scan may not have the correct policy
- Access controls may not be set correctly
- Notifications may be sent to the wrong people

### Resources:

- [Automatic Application Creation](https://help.sonatype.com/en/automatic-application.html "Automatic Applications")

## Onboarding through Source Control Managers

[Easy SCM Onboarding](https://help.sonatype.com/en/easy-scm-onboarding.html "Easy SCM Onboarding") lets you select applications to onboard through a point-and-click menu in the UI.

- Scans are run against the source code.
- Scanners will look for dependency lock files as well as binaries.
- Look for common language-specific patterns.
- Review the [analysis documentation](https://help.sonatype.com/en/analysis.html "Analysis") for details.

### Pitfalls:

- Manifest scanning does not provide a complete risk analysis of your built application.
- A complete scan will still need to be added during the build process.

## Onboarding Scripts (REST API)

Using the REST API to configure applications preemptively or in real-time.

- Directly integrate into your application management systems
- Recommended for a large number of applications or self-service growth
- Match to your internal systems using ids, application names, and existing groups

### Pitfalls:

- DO NOT test onboarding scripts in production; start with a backup.
- Major deployments are challenging to roll back or correct.
- Fully test scripts in a development environment before production.
- Monitor systems for irregularities and stability.

### Resources:

- Onboarding Organizations - [python script](https://github.com/ctolo/iq-onboarding-organizations)
- Adding Applications - [python script](https://github.com/ctolo/iq-add-applications/blob/master/iq_add_application.py)