Dependency-Track Working

[bhuvi11]

Hello Team,

I am new to SBOM and Dependency Track.
I started Dependency Track using docker-compose and i am able to see the UI.
The only way i can see vulnerabilities is through importing SBOM ? or can i import the jar for the application?

How different is this from Dependency Check? It also shows the vulnerabilities in the dependencies included in the project

[stevespringett]

The only way i can see vulnerabilities is through importing SBOM?

Correct. Generating build-time SBOMs is a good engineering practice, and requirements of NIST SSDF, OWASP SCVS, and BSIMM

Dependency-Track is a Component Analysis platform. Dependency-Check is an SCA tool.

See: https://docs.dependencytrack.org/odt-odc-comparison/