Lion Cipher Lab
Run continuous SBOM vulnerability triage with OWASP Dependency-Track
- AppSec / DevSecOps
- Advanced
- ~75 min
- Free · no account required
Why it matters
Creating an SBOM is the easy half; the value is in what consumes it, forever. A one-shot scan (syft to list components, trivy to scan an image once) answers 'what is vulnerable RIGHT NOW,' and that answer rots the instant a new CVE is published against a library you already shipped. Software supply-chain risk is not a point-in-time property — the code on the box did not change, but the world's knowledge about it did. OWASP Dependency-Track is built for exactly that: it is a continuous, aggregated Component Analysis platform. You upload CycloneDX SBOMs over time, it correlates every component…
What you'll learn
- deploying OWASP Dependency-Track locally with its official Docker Compose (apiserver + frontend)
- the concrete difference between SBOM CREATION (syft/cdxgen) and continuous, aggregated Component Analysis (Dependency-Track)
- generating a CycloneDX SBOM from a deliberately-vulnerable project and uploading it through the UI
- uploading BOMs over the REST API with a scoped API key so the exact flow drops into CI
- reading an aggregated vulnerability inventory correlated across NVD, OSV, and GitHub Advisories
- authoring a security policy (fail on Critical) and reading the resulting policy violation
- auditing a finding: recording a VEX analysis state (NOT_AFFECTED + justification + comment) and suppressing a false positive
- the honest limits — SBOM quality gates result quality, presence is not exploitability — and the CI-gating do-it-better step
Steps in this lab
- Creation vs. continuous management: what Dependency-Track actually is
- Stand up Dependency-Track locally with Docker Compose
- Create a project to hold your SBOMs
- Build a deliberately-vulnerable app and generate its CycloneDX SBOM
- Upload the BOM through the UI
- Upload the BOM over the REST API with an API key (CI-ready)
- Read the aggregated vulnerability inventory and audit views
- Author a policy that fails on Critical — and watch it fire
- Audit a finding: record a VEX decision and suppress a false positive
- Why continuous beats point-in-time — the limits, and doing it better