Integrate OWASP Dependency-Track with Vulnetix. Upload CycloneDX SBOMs, retrieve vulnerability findings via the REST API, and forward to Vulnetix for unified risk management.
Install & scan
$ # Deploy via Docker (bundled API server + frontend) docker run -d -p 8080:8080 --name dependency-track -v "dependency-track:/data" dependencytrack/bundled $ # Upload a CycloneDX SBOM via API DT_URL="http://localhost:8080" DT_APIKEY="your-api-key" PROJECT_UUID="your-project-uuid" curl -s -X PUT "$DT_URL/api/v1/bom" -H "X-Api-Key: $DT_APIKEY" -F "project=$PROJECT_UUID" -F "bom=@bom.json"
Run Dependency-Track in CI
Scan on every push and upload the report as a workflow artifact:
- name: Upload SBOM to Dependency-Track
env:
DT_URL: ${{ secrets.DT_URL }}
DT_APIKEY: ${{ secrets.DT_APIKEY }}
DT_PROJECT: ${{ secrets.DT_PROJECT_UUID }}
run: |
curl -s -X PUT "$DT_URL/api/v1/bom" -H "X-Api-Key: $DT_APIKEY" -F "project=$DT_PROJECT" -F "bom=@bom.json"
sleep 60
- name: Export findings from Dependency-Track
run: |
curl -s "$DT_URL/api/v1/finding/project/$DT_PROJECT" -H "X-Api-Key: $DT_APIKEY" | jq '.' > dt-findings.json
- name: Upload to Vulnetix
run: vulnetix upload --file dt-findings.json
How Vulnetix compares: better together
Vulnetix does not replace Dependency-Track. Keep running it. Vulnetix sits on top of Dependency-Track (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Dependency-Track is strongest at its core category and also carries features in License Compliance, SBOM Generation, just as Vulnetix spans categories.
| Capability | Vulnetix | Dependency-Track |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✓ Core: continuously matches SBOM components against NVD/OSV/GHSA/OSS Index/Snyk/Trivy/VulnDB |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✓ Tracks license risk per component using SPDX IDs; license policy enforcement |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ~ Consumes CycloneDX SBOMs and produces CycloneDX VEX; not a code-scanning SBOM generator |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ~ EPSS scoring supported for remediation prioritisation; no CISA KEV/ESS/LEV blend |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ~ Consumes and produces CycloneDX VEX; no immutable/versioned VEX-audit chain |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Dependency-Track does well
- Best-in-class CycloneDX SBOM ingestion and continuous portfolio-wide component monitoring, re-evaluating every project whenever new advisories land
- Aggregates many vulnerability intelligence sources in one place: NVD, OSV, GitHub Advisories, Sonatype OSS Index, Snyk, Trivy, VulnDB
- Mature, granular policy engine with global and per-project policies for security, license and operational compliance, plus SPDX license-risk tracking
- API-first, free/OSS, with EPSS scoring and native integrations to DefectDojo, Fortify SSC, ThreadFix and Kenna
Where Vulnetix adds to it: Both consume CycloneDX SBOMs, but Vulnetix adds the scanner breadth D-Track lacks (SAST/Semgrep, IaC, container, secrets, cloud, malware+package firewall) and richer prioritisation (EPSS + CISA KEV + Coalition ESS + CWSS + LEV, reachability via tree-sitter, SSVC) plus Safe Harbour autofix and immutable versioned VEX. D-Track remains the deeper dedicated SBOM-monitoring engine; Vulnetix ingests and orchestrates its component findings into one cross-scanner queue.
No migration, no rip-and-replace. Dependency-Track keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Dependency-Track results in Vulnetix
Upload Dependency-Track CycloneDX, SPDX, JSON, CSV output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.