Support for VEX Export

[italvi]

Is your feature request related to a problem? Please describe When sharing the mitigation information the generated HTML Report is useful for the management but not useful for having a machine-readable format

Describe the solution you'd like As a supplier of SBOMs I would like to provide a VEX with the SBOM, so customers won't ask for every single component whether we are affected.

Describe alternatives you've considered DependencyTrack is already providing this feature but unfortunately it does not have the capabilities of managing vulnerabilities like DefectDojo, therefore I would prefer to have such a feature in DD.

Question: Is this a planned feature? You are already supporting the import of VEX through CycloneDX 1.4.

[damiencarol]

I had some discussion with @Gby56 about this support. I don't know if somebody is working on it currently.

[italvi]

@damiencarol and what is your opinion on that? Do you also think that this is an useful feature?

[damiencarol]

yes.

[lme-nca]

I just want to mention a ticket on dependencytrack side: https://github.com/DependencyTrack/dependency-track/issues/1926 its also regarding syncing risk acceptance and other information back to dependencytrack. Would be great to have a feature like this and integrate it into the VEX generated by Dependency-track.

[italvi]

@damiencarol, @mtesauro I just wanted to mention that we will start working on this feature. However, the question would be, whether this complies with your feature-freeze due to the v3 release?

[mtesauro]

Sorry, busy week and just seeing this. Let me as the core contributors and get back to you.

[italvi]

@mtesauro Thanks, will wait for your feedback.

[manuel-sommer]

Hi @mtesauro, reminder: this issue is still waiting for feedback.

[Sebastianmueller22]

What is the status on this issue? Honestly might be a huge factor in wether or not my company will adopt defect dojo.

Especially syncing the triage back to Depenedency Track. Wether that is automatic or via VEX import is secondary

[valentijnscholten]

There are currently no plans to add SBOM or VEX support. These are more specific SCA functions that are (currently) better handled by specialized systems such as Dependency Track.

Adding a two way sync with Dependency Track would be a large task to undertake and maintain. It's already challenging to keep the two way sync with JIRA working. In Defect Dojo Pro we are using a "connector" based approach where there are modules external to Defect Dojo that implement syncs with other systems.

We could well see a community provided/maintain module that syncs between Dependency Track and Defect Dojo.

Some options that are already usable now:

• Defect Dojo does have an API that Dependency Track could use to implement a bi-directional sync.
• Defect Dojo also webhook notifications that could be used to send signals to Dependency Track with updated data or as a trigger to instruct Dependency Track to fetch new data from Defect Dojo.