Dependency-Track

ReARM relies on Dependency-Track for SBOM analysis, including vulnerability scans and policy violations. If you are using ReARM Pro, Dependency Track integration will be set up for you by Reliza. If you are using ReARM Community Edition or your organization on ReARM Public Demo, follow these instructions below:

Pre-requisites

You need to have a running instance of Dependency-Track. Any instance works, however it was deployed. Dependency-Track 5 is recommended; Dependency-Track 4 is also supported.

If you do not have one yet, we publish a Dependency-Track 5 Helm chart that bundles PostgreSQL and proxies the API through the frontend, so both URIs below are the same value.

Dependency-Track Part

1. In your Dependency-Track instance, open Administration section in the menu bar on the left.
2. Open Access Management->Teams in the next menu.
3. Create new Team called ReARM.
4. Click on ReARM Team and on Plus icon in the API Keys section. This will create an API Key - note this key.
5. Click on the Plus icon in the Permissions section and select following permissions:

• BOM_UPLOAD
• PORTFOLIO_MANAGEMENT
• PROJECT_CREATION_UPLOAD
• VIEW_POLICY_VIOLATION
• VIEW_PORTFOLIO
• VIEW_VULNERABILITY

6. Note that Dependency-Track would use configured Violation Policies and Vulnerability Scan Settings - refer to Dependency-Track documentation to configure those for your needs.
7. On Dependency-Track 5, turn on alias synchronization (aliasSyncEnabled) in the settings of the OSV vulnerability source, and check it is on (the default) for GitHub Advisories if you enable that source. If OSV has already mirrored, run one full re-mirror: turn incremental mirroring off for one run, then back on.

Why alias synchronization matters

Without it, Dependency-Track 5 reports GitHub and OSV advisories without their CVE ids. ReARM then knows such a vulnerability by its GHSA or OSV id only, so matching against the CISA Known Exploited Vulnerabilities catalog, which lists CVE ids, misses it. Only a full mirror adds aliases to advisories already stored. On the next Dependency-Track sync after that, ReARM moves each such vulnerability to its CVE id without new-vulnerability notifications. That sync can still send vulnerability update notifications for what the CVE id brings: a KEV listing ReARM can now match, and an EPSS score of 0.7 or more that ReARM learns for the first time.

ReARM Part

1. In ReARM, open Organization Settings from the menu on the left.
2. In the Integrations section, click on "Add Dependency-Track Integration" button.
3. Enter your Dependency-Track API Server URI (depending on your Dependency-Track installation, this may or may not be the same as your Frontend Server URI).
4. Enter your Dependency-Track Frontend URI (depending on your Dependency-Track installation, this may or may not be the same as your API Server URI).
5. Enter your API Key established in the Dependency-Track part above.
6. Click Submit - your integration is now configured.