Installing and setting up the vulnerability analysis tools

This page covers the installation, execution, and troubleshooting of the two tools used for vulnerability analysis: Dependency-Track and the OSV API.

Recommended order

Query quickly with the OSV API first, then set up continuous monitoring with Dependency-Track.

---

Installing and running Dependency-Track

Dependency-Track is an open source tool that automatically scans an uploaded SBOM for vulnerabilities and presents the results on a dashboard. The initial NVD data synchronization takes 10 to 30 minutes, so for self-study we recommend starting it in advance.

Docker Compose file (docker-compose.yml):

YAML

services:
  dtrack-apiserver:
    image: dependencytrack/apiserver:latest
    ports:
      - '8080:8080'
    volumes:
      - dtrack-data:/data
  dtrack-frontend:
    image: dependencytrack/frontend:latest
    ports:
      - '8081:8080'
    environment:
      - API_BASE_URL=http://localhost:8080
volumes:
  dtrack-data:

Run:

Bash

# After saving docker-compose.yml
docker compose up -d

# Wait for initialization (3-5 minutes)
# Open: http://localhost:8081
# Initial account: admin / admin (change it immediately)

SBOM upload and vulnerability scan steps:

1. Projects menu → Create Project (enter a name and version)
2. Click the created project → Components tab
3. Click the Upload BOM button
4. Select output/sbom/sbom.cdx.json and upload it
5. Check the results in the Vulnerabilities tab (analysis takes 1-2 minutes)

---

Quick lookup with the OSV API (without Dependency-Track)

OSV is an open source vulnerability database operated by Google. Without Docker, a single curl command looks up the vulnerabilities of a specific package.

Look up the vulnerabilities of a specific package:

Bash

# Look up vulnerabilities for log4j-core 2.14.1
curl -X POST https://api.osv.dev/v1/query \
  -H "Content-Type: application/json" \
  -d '{
    "package": {
      "name": "org.apache.logging.log4j:log4j-core",
      "ecosystem": "Maven"
    },
    "version": "2.14.1"
  }'

Maven packages must be queried in groupId:artifactId format. Using only the artifactId, such as log4j-core, returns an empty result ({}).

Batch query (multiple packages at once):

Bash

curl -X POST https://api.osv.dev/v1/querybatch \
  -H "Content-Type: application/json" \
  -d '{
    "queries": [
      {"package": {"name": "org.apache.logging.log4j:log4j-core", "ecosystem": "Maven"}, "version": "2.14.1"},
      {"package": {"name": "requests", "ecosystem": "PyPI"}, "version": "2.25.0"}
    ]
  }'

The vulnerability-analyst agent automatically reads the CycloneDX SBOM files in output/sbom/, queries the OSV API for each component, and compiles the results into a report. You do not need to type the curl commands yourself.

---

Troubleshooting

Symptom	Cause	Solution
Cannot reach Dependency-Track	Still initializing	Wait 3-5 minutes and retry
Zero vulnerabilities	NVD data still loading	Wait 10-30 minutes (on the first run)
No response from the OSV API	Network problem	Check connectivity with curl -I https://api.osv.dev
SBOM upload error	File format problem	Verify the CycloneDX JSON format and that the bomFormat field is present
Agent execution error	SBOM file missing	Check that a .cdx.json file exists in output/sbom/