Cyclone report doesn't contains vulnerability array

[jugalb-icpl]

I have exported Cyclone report but vulnerability array is missing, so it is importing 0 vulnerability

currently I am using below command
npx cdxgen --output sbom.json --spec-version 1.4

please help me regarding this

[valentijnscholten]

Could you let us know what you are tyring to achieve? Is it that you want to generate an SBOM for Defect Dojo?

[jugalb-icpl]

yes, we are scanning repositories for generating sbom report to be imported in defectdojo

[valentijnscholten]

If the vulnerability array is missing in the SBOM, then you will see 0 vulnerabilities in Defect Dojo.

cdxgen by itself doesn't scan for vulnerabilities, it only generates the bill of material. If you're looking to scan also for vulnerabilities and include those in the SBOM, you'll need something like trivy or grype.

Here's the dosc which has an example with grype: https://docs.defectdojo.com/en/connecting_your_tools/parsers/file/cyclonedx/

[jugalb-icpl]

Tried Grype earlier today, and it worked. However, I found GHSA vulnerabilities, although I was expecting CVE. But it's fine.

Thanks, man! Appreciate it.