What is Dependency-Track?
Dependency-Track is a Component Analysis platform that enables organisations to identify and reduce risk in the software supply chain. It provides continuous monitoring of your Software Bill of Materials (SBOM) for vulnerabilities, licence risks, and policy violations.Why Integrate with SCANOSS?
SCANOSS and Dependency-Track work together to provide a comprehensive software composition analysis workflow:- SCANOSS scans your codebase to identify all open-source components and generates a Software Bill of Materials (SBOM)
- Dependency-Track continuously monitors those components for vulnerabilities, licence risks, and policy violations
- Scans code on every push or pull request
- Analyses components against vulnerability databases
- Enforces security policies before merge
- Tracks vulnerabilities over time
- Alerts teams to newly disclosed threats
Key Features
Continuous Vulnerability Monitoring
Dependency-Track continuously monitors your dependencies against multiple vulnerability databases:- National Vulnerability Database (NVD): Comprehensive CVE database maintained by NIST
- GitHub Security Advisories: Community-curated vulnerability information
- OSS Index: Sonatype’s vulnerability database
- VulnDB: Commercial vulnerability intelligence
- Custom Sources: Configure additional vulnerability feeds via the Dependency-Track administration interface
Component Risk Management
Track and assess risk across your entire software portfolio:- Risk Scoring: Automated calculation of component risk based on vulnerabilities, age, and usage
- Component Inventory: Complete visibility into all components across projects
- Dependency Graphs: Visual representation of direct and transitive dependencies
- Lifecycle Management: Track component versions and end-of-life status
Policy Enforcement
Define and enforce organisational compliance policies:- Licence Policies: Block or warn on specific licences or licence groups
- Vulnerability Policies: Flag components based on CVE severity or specific CVEs
- Component Age Policies: Identify outdated components requiring updates
- Custom Policies: Define complex rules using multiple conditions
Audit and Compliance
Maintain compliance and auditability:- Audit Trail: Complete history of all vulnerability assessments and policy decisions
- Triage: Document why specific vulnerabilities are accepted or suppressed
- Reporting: Generate compliance reports for stakeholders
- Attribution: Track component licences and attribution requirements
Architecture Overview
How It Works
The SCANOSS–Dependency-Track integration follows this workflow:- Code Commit: Developer pushes code or creates a pull request
- SCANOSS Scan: GitHub Actions triggers a SCANOSS scan
- SBOM Generation: SCANOSS generates a CycloneDX or SPDX SBOM
- Upload to Dependency-Track: The SBOM is automatically uploaded to Dependency-Track
- Vulnerability Analysis: Dependency-Track analyses components against configured vulnerability databases
- Policy Evaluation: Defined policies are evaluated against the uploaded SBOM
- Feedback: Results are reported back to the pull request or build pipeline
Dashboard Components
The Dependency-Track dashboard provides several key views:Components Tab
- Complete inventory of detected components
- Licence information for each component
- Version details and package URLs (PURLs)
- Risk scores based on vulnerabilities and other factors
Dependency Graph
- Visual representation of component relationships
- Direct vs transitive dependencies
- Impact analysis for component upgrades
- Dependency hierarchy visualisation
Audit Vulnerabilities
- List of all components with known vulnerabilities
- Severity ratings (Critical, High, Medium, Low)
- CVE identifiers and descriptions
- Vulnerability analysis states
- Remediation guidance
Policy Violations
- Active policy violations across the project
- Violation severity (Info, Warn, Fail)
- Policy conditions that triggered the violation
- Triage status and justifications
Use Cases
CI/CD Integration
Integrate compliance checks into your development pipeline:- Block builds containing critical vulnerabilities
- Prevent merges that violate licence policies
- Generate SBOMs for every release
- Track dependency changes over time
Security Monitoring
Maintain continuous monitoring of your software supply chain:- Automated alerts for newly disclosed vulnerabilities affecting monitored components
- Identification of newly introduced security risks
- Centralised vulnerability management
- Security metrics and dashboards
Compliance Management
Maintain regulatory and organisational compliance:- Licence compliance verification
- Policy enforcement automation
- Audit trail documentation
- Compliance reporting for stakeholders
Portfolio Management
Manage software composition across your organisation:- Multi-project visibility
- Shared policy definitions
- Centralised component tracking
- Organisation-wide risk assessment
Prerequisites
Before integrating Dependency-Track with SCANOSS, you will need:- Running Dependency-Track Instance: Self-hosted or cloud-hosted. See the Dependency-Track documentation for setup guidance.
- Dependency-Track API Key: Obtained via Administration → Access Management → Teams → API Keys
- Base URL: The URL at which your Dependency-Track instance is accessible
- SCANOSS API Key: Required for scanning your codebase. See the SCANOSS documentation for details on obtaining a key.
- GitHub Repository: With Actions enabled (required for CI/CD integration)
Next Steps
To get started with Dependency-Track and SCANOSS:- Configuration: Set up your Dependency-Track instance and configure API access
- GitHub Integration: Create a workflow to automatically upload SBOMs
- Policy Setup: Define organisational policies for licences, vulnerabilities, and components
- Usage: Learn how to manage vulnerabilities and triage policy violations