You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
These analyzers send component identifiers to a remote service at analysis time and receive vulnerability findings
40
+
in return. Results reflect the current state of the remote service, but are subject to network availability,
41
+
rate limits, authentication requirements, and the remote service's own update schedule.
42
+
To reduce redundant requests, results are cached locally for 12 hours by default
43
+
(see [Analysis Result Cache](#analysis-result-cache)).
44
+
45
+
### Vulnerability Assignment and Persistence
46
+
47
+
Once Dependency-Track assigns a vulnerability to a component, that assignment **persists even if the upstream
48
+
source data later changes** — for example, if a CVE's affected version ranges are revised to exclude the
49
+
component's version, or if the vulnerability is retracted entirely.
50
+
51
+
This is by design: automatically removing assigned vulnerabilities could silently erase audit trails and analyst
52
+
work. Dependency-Track re-evaluates components during each analysis run and may add newly discovered
53
+
vulnerabilities, but it does not remove existing ones.
54
+
55
+
If a previously assigned vulnerability is determined to be incorrect, it must be explicitly addressed by setting
56
+
an appropriate analysis state on the finding (e.g. *False Positive* or *Not Affected*).
57
+
20
58
### Internal Analyzer
21
59
22
-
The internal analyzer relies on a dictionary of vulnerable software. This dictionary is automatically populated when
23
-
NVD, GitHub Advisories, OSV, or VulnDB mirroring is performed. The internal analyzer is applicable to all components
24
-
with valid CPEs or PURLs, including application, operating system, and hardware components, and all components with
25
-
Package URLs.
60
+
The Internal Analyzer relies on a local dictionary of vulnerable software. This dictionary is automatically
61
+
populated when NVD, GitHub Advisories, OSV, or VulnDB mirroring is performed. Which identifier is used for
62
+
matching depends on the mirrored data source:
63
+
64
+
***CPE** — used for data from the NVD and VulnDB mirrors.
65
+
***PURL** — used for data from the GitHub Advisories and OSV mirrors.
66
+
67
+
A component needs at least one valid identifier to be analyzed. Components with both a CPE and a PURL are
68
+
evaluated against all applicable mirrored data sources.
26
69
27
70
#### CPE Matching
28
71
29
72
Matching against data from the NVD requires components to have a valid CPE. Dependency-Track follows
30
-
the [NIST CPE name matching specification](https://nvlpubs.nist.gov/nistpubs/Legacy/IR/nistir7696.pdf),
73
+
the [NIST CPE name matching specification](https://nvlpubs.nist.gov/nistpubs/Legacy/IR/nistir7696.pdf),
31
74
with a few customizations.
32
75
33
76
To reduce false positives, the following additional checks are performed:
34
77
35
78
* If comparison of *vendor* yields `SUBSET`, and comparison of *product* yields `SUPERSET`, then it's a no-match
36
-
* If comparison of *vendor* yields `SUPSERSET`, and comparison of *product* yields `SUBSET`, then it's a no-match
79
+
* If comparison of *vendor* yields `SUPERSET`, and comparison of *product* yields `SUBSET`, then it's a no-match
37
80
38
81
This is to avoid component CPEs like `cpe:2.3:a:*:zstandard:1.5.2:*:*:*:*:*:*:*` from getting matched to
39
82
CVE CPEs like `cpe:2.3:a:pascom_cloud_phone_system:*:*:*:*:*:*:*:*:*`.
40
83
41
-
Dependency-Track will emit a log in`DEBUG` level whenever it discards matches due to the above.
84
+
Dependency-Track will emit a log at`DEBUG` level whenever it discards matches due to the above.
42
85
43
86
### OSS Index Analyzer
44
87
45
-
OSS Index is a service provided by Sonatype which identifies vulnerabilities in third-party components. The service
46
-
supports a wide range of package management ecosystems. Dependency-Track integrates natively with OSS Index to provide
47
-
highly accurate results. This analyzer is applicable to all components with valid Package URLs.
88
+
> **Requires:** A valid Package URL (PURL). Components without a PURL are not analyzed by OSS Index.
48
89
49
-
> Starting with Dependency-Track v4.0, OSS Index is enabled by default and does not require an account. For prior
50
-
> Dependency-Track versions, OSS Index is disabled by default and requires an account. To enable OSS Index,
51
-
> sign up for a free account and enter the account details in Dependency-Track in the 'Analyzers' settings in the
52
-
> administrative console.
90
+
OSS Index is a service provided by Sonatype which identifies vulnerabilities in third-party components. The
91
+
service supports a wide range of package management ecosystems. Dependency-Track integrates with OSS Index using
92
+
its public API — vulnerability data is not mirrored locally, but consumed on an as-identified basis.
53
93
54
-
OSS Index is a source of vulnerability intelligence that provides its own content. Refer to
55
-
[OSS Index (Datasource)]({{ site.baseurl }}{% link _docs/datasources/ossindex.md %}) for additional information.
94
+
> **Note:** Unauthenticated usage of OSS Index is no longer supported. An API token is required.
95
+
> Refer to [OSS Index (Datasource)]({{ site.baseurl }}{% link _docs/datasources/ossindex.md %}) for
96
+
> configuration details.
56
97
57
98
### VulnDB Analyzer
58
99
59
-
VulnDB is a subscription service offered by Risk Based Security. The VulnDB Analyzer is capable of analyzing all
60
-
components with CPEs against the VulnDB service. Use of this analyzer requires a valid CPE for the components being
61
-
analyzed.
100
+
> **Requires:** A valid CPE. Components without a CPE are not analyzed by the VulnDB Analyzer.
101
+
102
+
VulnDB is a subscription service offered by Flashpoint. The VulnDB Analyzer queries the VulnDB REST APIs at
103
+
analysis time to identify vulnerabilities in components. Dependency-Track does not mirror VulnDB data for this
104
+
analyzer — it is consumed on an as-identified basis.
62
105
63
-
VulnDB is a source of vulnerability intelligence that provides its own content. Refer to
64
-
[VulnDB (Datasource)]({{ site.baseurl }}{% link _docs/datasources/vulndb.md %}) for additional information.
106
+
> VulnDB data can also be ingested into the Internal Analyzer via the VulnDB mirror. Refer to
107
+
> [VulnDB (Datasource)]({{ site.baseurl }}{% link _docs/datasources/vulndb.md %}) for additional information.
65
108
66
109
### Snyk Analyzer
67
110
68
-
It is a service provided by Snyk which identifies vulnerabilities in third-party components using REST API. Snyk returns only direct vulnerabilities for a specific package version identified by Package URL (purl).
69
-
This analyzer is applicable to all components with valid Package URLs.
111
+
> **Requires:** A valid Package URL (PURL). Components without a PURL are not analyzed by Snyk.
70
112
71
-
Snyk REST API version is updated every 6 months and can be referred at
72
-
[Snyk REST API for PURL](https://apidocs.snyk.io/?version=2022-10-06#get-/orgs/-org_id-/packages/-purl-/issues) for additional information.
113
+
Snyk is a commercial service that identifies vulnerabilities in third-party components using its REST API. Snyk
114
+
returns direct vulnerabilities for a specific package version identified by PURL. Vulnerability data is not
115
+
mirrored locally — it is consumed on an as-identified basis.
116
+
117
+
Refer to [Snyk (Datasource)]({{ site.baseurl }}{% link _docs/datasources/snyk.md %}) for configuration details.
73
118
74
119
### Trivy Analyzer
75
120
76
-
Trivy analyzer relies on a server trivy instance to perform the analysis using REST API.
77
-
Trivy REST API is not publically documented so upgrading to a new version might lead to some issues.
121
+
> **Requires:** A valid Package URL (PURL). Components without a PURL are not analyzed by Trivy.
122
+
123
+
The Trivy Analyzer sends components to an external Trivy server instance for analysis using its REST API.
124
+
The Trivy integration requires a separately deployed Trivy server and is disabled by default.
125
+
126
+
> The Trivy server REST API is not publicly documented, so upgrading to a new version may introduce
127
+
> compatibility issues. Refer to [Trivy (Datasource)]({{ site.baseurl }}{% link _docs/datasources/trivy.md %})
128
+
> for deployment instructions and known limitations.
78
129
79
130
### Analysis Result Cache
80
131
81
132
Dependency-Track contains an internal limiter which prevents repeated requests to remote services when performing
82
-
vulnerability analysis. When a component's Package URL or CPE is successfully analyzed by a given analyzer,
133
+
vulnerability analysis. When a component's Package URL or CPE is successfully analyzed by a given analyzer,
83
134
the result is cached. By default, cache entries expire after 12 hours.
135
+
136
+
### Troubleshooting False Positives and False Negatives
137
+
138
+
Before reporting a false positive or false negative as a bug, work through the following steps.
139
+
140
+
#### Step 1: Verify the component's identifiers in Dependency-Track
141
+
142
+
Navigate to the component in question and confirm it has a valid CPE and/or PURL, as required by the
143
+
analyzer(s) you expect to produce results (see the table at the top of this page). A missing, empty, or
144
+
malformed identifier causes the analyzer to silently skip the component and is the most common cause of
145
+
unexpected results.
146
+
147
+
#### Step 2: Check the vulnerability's affected ranges in Dependency-Track
148
+
149
+
Open the vulnerability in Dependency-Track and review the affected version ranges it lists. If the component's
150
+
version does not fall within any listed range, Dependency-Track correctly does not match it — this is expected
151
+
behavior, not a bug.
152
+
153
+
#### Step 3: Compare with the upstream source
154
+
155
+
* For the **Internal Analyzer**, cross-reference the relevant upstream source directly:
0 commit comments