Dependency Track
summary
Open source platform that ingests a CycloneDX bill-of-material or SPDX files and continuously monitors components against NVD NPM Public Advisories Sonatype OSS Index and VulnDB, pulling vulnerability metadata and outdated-version signals every 24 hours. It exposes an API webhooks and a Jenkins plugin so automation can create pull requests or JIRA tickets, retains full audit history and allows marking findings as false positive. Uses package URL routing to pick the right intelligence source and reports that roughly 90% of disclosed issues are not present solely in the NVD.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:33Dependency Track
- 3:04Software Bill of Material
- 4:56Vulnerability Analysis
- 5:35Bill of Material Support
- 7:06Bill of Material
- 8:45Dependency Tracking
- 10:55Package URL
- 18:47Package NPM
- 27:25Vulnerability List
- 28:55Vulnerability Audit
related talks
54mSupply Chain Sec /w Dependency Track
25mFlagship Projects: Dependency Track
24mDependency Track Fortifying The Supply Chain
46mSafely through the dependency minefield using OWASP Dependency Track
42mIt's a trap; we are vulnerable
01h 00mDependency Check Project
26mEffective Software Supply Chain Monitoring
27mFind and Track the hidden vulnerabilities inside your dependencies