DependencyTrack / DependencyTrack/dependency-track
Add Support for Import of Threat Intelligence
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
A Dependency-Track instance with a couple of hundred projects (which is not that many, really) can still be tracking many thousands of portfolio vulnerabilities. This can become a real challenge to manage, especially considering that research shows that only about 5% of identified vulnerabilities actually matter.
But which 5%? Dependency-Track does support EPSS, but what is needed is threat intelligence on steroids.
### Proposed Behavior
Investigate and add support to Dependency-Track for the import of [STIX](https://oasis-open.github.io/cti-documentation/stix/intro) data via [MISP](https://www.misp-project.org/), [OpenCTI](https://www.opencti.io/) and other threat intelligence platforms.
The integration will require a research spike in order to determine feasibility and how to tie to CVEs, the providers of APIs in Dependency-Track inventory, etc.
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.