Dependency-Track Tutorial: Features, Use Cases, How It Works

TL;DR, What is Dependency-Track?

OWASP Dependency-Track is a component analysis platform that helps secure your software supply chain. The tool gives DevSecOps teams continuous visibility into their software, helping you manage risks from vulnerabilities, old components, and license issues. Dependency-Track uses the software bill of materials (SBOM) standard to analyze dependencies, integrating directly into CI/CD pipelines so you can always track what components you’re using and where. As an OWASP flagship project, Dependency-Track is a community-driven tool for securing modern development.

Catch code risks before you deploy

Learn how Wiz Code scans IaC, containers, and pipelines to stop misconfigurations and vulnerabilities before they hit your cloud.

Work Email*

First Name*

Last Name*

Country

Phone Number*

Company*

Keep me updated about Wiz product releases, industry news, and events (You can unsubscribe at any time)

Subscribe me to the Wiz blog digest emails

Submit

For information about how Wiz handles your personal data, please see our Privacy Policy.

Your work email here

Get a demo

At-A-Glance

• GitHub: https://github.com/DependencyTrack/dependency-track

• License: Apache-2.0

• Primary Language: Java

• Stars: 3.2k ⭐

• Last Release: v4.13.4 (August 26, 2024)

• Topics/Tags: software-supply-chain-security, sca, sbom, cyclonedx, vex, vulnerability-management, component-analysis, license-compliance, owasp, owasp-project

Common use cases

1. Automated CI/CD Pipeline Security: You can embed Dependency-Track into CI/CD pipelines to automate software composition analysis (SCA). With every build, the pipeline uploads an SBOM for a policy scan. The scan fails the build if it finds high-risk vulnerabilities or licenses that don't comply with your policies.

2. Enterprise Software Supply Chain Governance: Large organizations use Dependency-Track to create a central component inventory and enforce consistent risk policies across their entire software portfolio. The central inventory provides a single view of component usage and helps you coordinate responses to new software supply chain security threats.

3. Continuous Compliance and Auditing: In regulated industries, teams use Dependency-Track to maintain a detailed SBOM inventory for compliance. The tool continuously monitors for license violations and generates reports on component risks, giving you the evidence needed for auditors and regulators.

4. Incident Response and Impact Analysis: Incident response teams use the platform to quickly assess the impact of new vulnerabilities. You can instantly query the entire portfolio to find every instance of a vulnerable component, which helps you prioritize patching and remediate faster.

5. Third-Party Software Vetting: You can ingest a vendor's CycloneDX SBOM to analyze third-party software for security and license risks before deployment. Proactive vetting with Dependency-Track ensures any software you acquire meets your internal security standards and governance policies.

wiz academy

The Top 11 Open-Source SBOM tools

Read more

How does Dependency-Track work?

Dependency-Track works by taking in a SBOM, analyzing it against threat intelligence, and reporting what it finds. The process starts when you upload an SBOM in CycloneDX format from a CI/CD pipeline or the web interface. A core API server parses the inventory and stores component details in its database. The system then checks these components against multiple vulnerability intelligence sources to find risks and policy violations, displaying the results on a dashboard.

Key operations include:

• SBOM Ingestion: A Java-based API server processes CycloneDX SBOMs, pulling out a detailed inventory of all software components and how they relate.

• Continuous Vulnerability Analysis: The tool constantly matches the component inventory against multiple intelligence feeds (like NVD, GitHub Advisories, and OSS Index) to find known security vulnerabilities. Dependency-Track automatically analyzes all projects when new threats appear.

• Policy Enforcement: A built-in engine checks components against your configured security, license, and operational policies to flag violations.

• Visualization & Reporting: A PostgreSQL database stores all findings, which are shown in a clean Vue.js dashboard. You can also send optional notifications to platforms like Slack and Microsoft Teams.

CI/CD Best Practices [Cheat Sheet]

This comprehensive guide provides you with actionable best practices to mitigate CI/CD security risks.

Your work email here

Download cheat sheet

Core Capabilities

1. SBOM-Centric Component Inventory: Dependency-Track ingests SBOMs to create a real-time inventory of all software components across your portfolio, including libraries, frameworks, and containers. Using SBOMs for analysis provides deep visibility into component lineage and dependencies, which is key for modern software supply chain security. An accurate inventory helps you maintain an auditable record of your software assets for better vulnerability management and compliance.

2. Vulnerability Intelligence Aggregation: The platform integrates with many public and commercial vulnerability intelligence sources like NVD, GitHub Advisories, and Snyk. Pulling from multiple sources ensures broad coverage and lowers the risk of missing critical vulnerabilities. The system continuously syncs with these sources: When a new vulnerability is found, the platform automatically re-evaluates all inventoried components across your entire portfolio. Proactive analysis gives security teams near-real-time alerts for new risks, so you can respond quickly without manual rescanning.

3. Automated Policy Enforcement Engine: A flexible policy engine helps you enforce security, license, and operational risk standards. You can define global or per-project policies based on criteria like vulnerability severity (CVSS score), exploitability, license type, and component age. The engine automatically checks every component against these policies during SBOM analysis. If the engine detects a violation, like a component with a critical vulnerability or a non-compliant license, the system generates a finding and can trigger alerts or fail a CI/CD build to automate governance.

4. Portfolio-Wide Risk and Impact Analysis: The tool gives you a centralized, portfolio-wide view of software risk by tracking every component and its usage across all versions of every application. When a new high-profile vulnerability is disclosed, security teams can instantly query the system to find every instance of the affected component and determine the threat's "blast radius." A clear view of the impact allows you to prioritize remediation based on which applications are most critical or exposed, improving your software supply chain security.

5. API-First Design for DevOps Integration: The platform has an API-first architecture designed for automation, exposing all functionality through a REST API for easy integration into CI/CD pipelines and security workflows. Official plugins for tools like Jenkins and GitHub Actions make it simple to automatically upload SBOMs during the build process. Deep integration ensures that software composition analysis (SCA) becomes an automated part of the development lifecycle. The result is faster feedback for developers and security that can scale with development.

Limitations

1. Dependency on High-Quality SBOMs: The tool's analysis is only as good as the SBOMs you feed it. Inaccurate or incomplete SBOMs from other tools can create blind spots where you miss vulnerable components, or they can create false positives that make the results less reliable.

2. Focus on Known Vulnerabilities: As an SCA tool, Dependency-Track finds known, publicly disclosed vulnerabilities in third-party dependencies. The tool is not designed to find zero-day threats or security flaws in your own custom code, so you should use it with other security testing tools for full coverage.

3. Potential for Alert Fatigue: Pulling data from many vulnerability sources can generate a lot of findings, especially in large applications. Without careful policy tuning and a good triage process, your security teams might get overwhelmed by alerts, which makes it harder to manage vulnerabilities effectively.

4. Complex Initial Setup and Configuration: Deploying the platform and integrating it into a large environment takes significant technical effort. Configuring the database, vulnerability feeds, CI/CD integrations, and writing effective policies creates a steep learning curve for new teams.

5. Does Not Natively Generate SBOMs: The tool analyzes SBOMs but does not create them. You must set up and maintain separate tools in your build pipelines to generate the SBOMs. An extra dependency on other tools adds another layer of complexity to your workflow.

Getting Started:

Step 1: Ensure Docker is installed on your system.

Step 2: Download the latest Docker Compose file:

curl -LO https://dependencytrack.org/docker-compose.yml

Step 3: Start Dependency-Track with Docker Compose:

docker-compose up -d

Step 4: Open your browser and navigate to http://localhost:8080. The application will be available after a short initial startup.

FAQ

Verified Dependency-Track User Reviews

Positive Reviews

G2

• "Its neat UI assisted by side nav bars and illustrative dashboards and tables as required is the best feature followed by ease of integration." - Atanu M. - Security Consultant

• "No restriction on the number of repositories one can scan." - Suryansh G. - Principal Engineer, Cloud HSM

• "Has multiple vulnerability sources (NVD, OSS Index, etc.) and thus higher positive percentage." - Vis C. - Software Security Technical Director

Negative Reviews

G2

• "The main shortcoming is that there is no way to export the data off of this tool. We end up resorting to the crude methods of copy pasting the data in excel for collaborating with development teams." - Atanu M. - Security Consultant

• "Access to zero day vulnerabilities is not there and only works with an old DB leaving an attack surface open" - Suryansh G. - Principal Engineer, Cloud HSM

• "Slow in performance, especially the GUI operations" - Vis C. - Software Security Technical Director

Alternatives