Flagship Projects: Dependency Track
summary
Dependency Track claims to ingest, analyze and produce software bills of materials at high velocity and it is Apache 2.0 licensed with about 4 million Docker pulls and a project history since 2013. It integrates CycloneDX tooling with 80+ tools in the tool center, pulls vulnerability feeds like NVD VulnDB and Sonatype OSS Index, supports SPDX and searches by purl CPE SWID or hash, runs continuous analysis every 24 hours and ships integrations to Slack Teams Jira etc.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:50Background
- 1:25Dependency Track
- 2:00Software Bill Material
- 3:13Cyclonedx
- 4:10What does it do
- 6:03Typical workflow
- 9:48Demo
- 11:42Time Series
- 11:52Number of Components
- 12:32List of Ingredients
- 13:47Dependency Graph
- 16:12Stock Quotes
- 20:22Policy Engine
related talks
54mSupply Chain Sec /w Dependency Track
46mSafely through the dependency minefield using OWASP Dependency Track
24mDependency Track Fortifying The Supply Chain
34mDependency Track
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
42mIt's a trap; we are vulnerable
23mSupply Chain Security using Free and Open Tools
19mSecuring the Software Factory