Hello,
I may be misunderstanding Faraday's purpose, but I have a question regarding dependency vulnerability management.
My goal would be to import a CycloneDX SBOM (or simply a list of dependencies and versions) and have Faraday itself retrieve vulnerability data from sources such as NVD, perform the CVE correlation/mapping against the detected dependency versions, and continuously track newly disclosed vulnerabilities over time.
From what I understand, the current workflow seems to rely on external tools such as OWASP Dependency-Check to already perform the analysis and generate findings, which are then imported into Faraday.
Is there a way for Faraday to perform this CVE enrichment and dependency-to-vulnerability mapping itself, effectively acting as a replacement for Dependency-Track? Or is Faraday intentionally designed to only aggregate and manage findings produced by other security tools?
Thank you.
Hello,
I may be misunderstanding Faraday's purpose, but I have a question regarding dependency vulnerability management.
My goal would be to import a CycloneDX SBOM (or simply a list of dependencies and versions) and have Faraday itself retrieve vulnerability data from sources such as NVD, perform the CVE correlation/mapping against the detected dependency versions, and continuously track newly disclosed vulnerabilities over time.
From what I understand, the current workflow seems to rely on external tools such as OWASP Dependency-Check to already perform the analysis and generate findings, which are then imported into Faraday.
Is there a way for Faraday to perform this CVE enrichment and dependency-to-vulnerability mapping itself, effectively acting as a replacement for Dependency-Track? Or is Faraday intentionally designed to only aggregate and manage findings produced by other security tools?
Thank you.