DependencyTrack / DependencyTrack/dependency-track
Create an API interface that allows users to define other analysers/sources.
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
DT only allows hard coded analysers and vulnerability sources. There is internal, Sonatype, VulnDB, Snyk and Trivy as examples.
At the moment you cannot connect to ones that have not been predefined.
### Proposed Behavior
NVD has become a little out of date in that they are stretched to getting vulnerabilities validated etc.
We were looking to access another, but not one of the ones already defined such as Trivy.
It is an internal one to our company and it has an API and returns the following sort of data via an API call.

I was wondering if DT was set up, or could be set up, so that you could create a new vulnerability reporting service.
e.g. the user would have a predefined set of fields that they would need to create for the call and then map the responses back to the 'fields' that DT requires to be able to use it internally.
This could remove the limit of the current hard coded ones. I guess it could then be made to allow this 'framework' to be exported and imported into any other DT instances to use.
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.