DependencyTrack / DependencyTrack/dependency-track

Create an API interface that allows users to define other analysers/sources.

Open
#5,031 1 comment 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior
DT only allows hard coded analysers and vulnerability sources. There is internal, Sonatype, VulnDB, Snyk and Trivy as examples.

At the moment you cannot connect to ones that have not been predefined.

### Proposed Behavior

NVD has become a little out of date in that they are stretched to getting vulnerabilities validated etc.

We were looking to access another, but not one of the ones already defined such as Trivy.

It is an internal one to our company and it has an API and returns the following sort of data via an API call.

![image](https://github.com/user-attachments/assets/37d1f78b-0920-42af-ad1a-e8f801648f8f)

I was wondering if DT was set up, or could be set up, so that you could create a new vulnerability reporting service.

e.g. the user would have a predefined set of fields that they would need to create for the call and then map the responses back to the 'fields' that DT requires to be able to use it internally.

This could remove the limit of the current hard coded ones. I guess it could then be made to allow this 'framework' to be exported and imported into any other DT instances to use.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.