{"action":"created","issue":{"url":"https://api.github.com/repos/DependencyTrack/dependency-track/issues/174","repository_url":"https://api.github.com/repos/DependencyTrack/dependency-track","labels_url":"https://api.github.com/repos/DependencyTrack/dependency-track/issues/174/labels{/name}","comments_url":"https://api.github.com/repos/DependencyTrack/dependency-track/issues/174/comments","events_url":"https://api.github.com/repos/DependencyTrack/dependency-track/issues/174/events","html_url":"https://github.com/DependencyTrack/dependency-track/issues/174","id":338483170,"node_id":"MDU6SXNzdWUzMzg0ODMxNzA=","number":174,"title":"Question: Does Dependency-Track NVD updates require a new scan to be run?","user":{"login":"quentinkhoo","id":33711159,"node_id":"MDQ6VXNlcjMzNzExMTU5","avatar_url":"https://avatars3.githubusercontent.com/u/33711159?v=4","gravatar_id":"","url":"https://api.github.com/users/quentinkhoo","html_url":"https://github.com/quentinkhoo","followers_url":"https://api.github.com/users/quentinkhoo/followers","following_url":"https://api.github.com/users/quentinkhoo/following{/other_user}","gists_url":"https://api.github.com/users/quentinkhoo/gists{/gist_id}","starred_url":"https://api.github.com/users/quentinkhoo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quentinkhoo/subscriptions","organizations_url":"https://api.github.com/users/quentinkhoo/orgs","repos_url":"https://api.github.com/users/quentinkhoo/repos","events_url":"https://api.github.com/users/quentinkhoo/events{/privacy}","received_events_url":"https://api.github.com/users/quentinkhoo/received_events","type":"User","site_admin":false},"labels":[{"id":48104497,"node_id":"MDU6TGFiZWw0ODEwNDQ5Nw==","url":"https://api.github.com/repos/DependencyTrack/dependency-track/labels/question","name":"question","color":"cc317c","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-07-05T08:54:00Z","updated_at":"2018-07-06T16:09:52Z","closed_at":null,"author_association":"NONE","body":"Hi @stevespringett \r\n\r\nI would like to clarify if I have a use case situation as follow\r\n\r\n1) A scan is done on an application `TestApplication` through Jenkins' dependency-check plugin\r\n2) The results are uploaded to dependency-track and dependency-track stores the list of dependencies.\r\n3) Dependency-track displays the list of vulnerabilities based on the current NVD.\r\n4) Dependency-track then gets updated with the latest NVD mirror the next day (I believe this is done automatically?)\r\n\r\nAt this point, would the `TestAplication`'s archived list of dependencies (through the BOM file i believe? ) be updated based on the latest NVD and reflect any possibly new CVE discovered without having to do a new scan through dependency-check? If so, could you point me to the relevant portions of the code?\r\n\r\nI hope to hear from you soon."},"comment":{"url":"https://api.github.com/repos/DependencyTrack/dependency-track/issues/comments/403078340","html_url":"https://github.com/DependencyTrack/dependency-track/issues/174#issuecomment-403078340","issue_url":"https://api.github.com/repos/DependencyTrack/dependency-track/issues/174","id":403078340,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMzA3ODM0MA==","user":{"login":"stevespringett","id":3878933,"node_id":"MDQ6VXNlcjM4Nzg5MzM=","avatar_url":"https://avatars3.githubusercontent.com/u/3878933?v=4","gravatar_id":"","url":"https://api.github.com/users/stevespringett","html_url":"https://github.com/stevespringett","followers_url":"https://api.github.com/users/stevespringett/followers","following_url":"https://api.github.com/users/stevespringett/following{/other_user}","gists_url":"https://api.github.com/users/stevespringett/gists{/gist_id}","starred_url":"https://api.github.com/users/stevespringett/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevespringett/subscriptions","organizations_url":"https://api.github.com/users/stevespringett/orgs","repos_url":"https://api.github.com/users/stevespringett/repos","events_url":"https://api.github.com/users/stevespringett/events{/privacy}","received_events_url":"https://api.github.com/users/stevespringett/received_events","type":"User","site_admin":false},"created_at":"2018-07-06T16:09:52Z","updated_at":"2018-07-06T16:09:52Z","author_association":"MEMBER","body":"The PackageURL is really important. This is used by all the repository functionality in order to retrieve metadata about the component including if the component is out-of-date.\r\nhttps://github.com/DependencyTrack/dependency-track/tree/master/src/main/java/org/owasp/dependencytrack/tasks/repositories\r\n\r\nIn v3.2, the PackageURL will also be used (if available) for supplying the component name, group, and version to Dependency-Check for analysis. Currently, the components name, group, and version are used from the respective input fields. So it's important to get those right (at least in v3.1).\r\n\r\nThe CPE field is not currently being used, although it will be in a future release. To provide some perspective on why the CPE field will be used in a future release, take a look at https://www.youtube.com/watch?v=ve_adRN9YTE This is an excellent video that provides background information on bill-of-materials, CycloneDX, PackageURL and CPE.\r\n\r\nBased on the results from this survey https://twitter.com/DependencyTrack/status/1011379701737238528, I'll be implementing email and Slack/Teams notifications first, followed by generic webhook notifications. This is currently in active development. Follow https://github.com/DependencyTrack/dependency-track/issues/102 to stay up-to-date on this progress. The administrative UI is being reworked to provide additional capabilities including the ability to configure notifications.\r\n\r\n<img width=\"775\" alt=\"screen shot 2018-07-06 at 10 52 10 am\" src=\"https://user-images.githubusercontent.com/3878933/42388735-1ee1941c-810c-11e8-9a3a-7eaa95383b0f.png\">\r\n\r\n\r\n\r\n"}}
{"actor":{"display_login":"stevespringett"}}