📙 You will learn

How to configure Black Duck with ThreadFix.

Prerequisites

Audience: IT Professional or End User
Difficulty: Basic
Time needed: Approximately 5 minutes
Tools required: N/A

Introduction

As of version 2.8.4, ThreadFix no longer uses Black Duck's hub-common library to authenticate and pull application, version and vulnerability information, API calls are now used in its place.

Authentication

ThreadFix uses Black Duck's Access Token to authenticate and establish a connection with its service layer. This token is generated from Profile Page of the target Black Duck instance. 

Here's how to create your token:

1. Go to the Profile Page in Black Duck
   

   

2. Scroll to the bottom to find the User Access Token section.
   

3. Enter a name.
   

4. Select at least Read access for the scope.
   

5. Click Generate.
   

   Image RemovedImage Added

6. Copy the resulting API Token to Clipboard and Enter it into the Remote Providers section in ThreadFix.
   

   Image RemovedImage Added

Obtain Bearer Token

The following call is used to obtain the Bearer Token:

curl --location --request POST 'https://threadfixhub.blackducksoftware.com/api/tokens/authenticate' \
--header 'Authorization: token {APIKEY}' \
--header 'Accept: application/vnd.blackducksoftware.user-4+json'

Fetching Applications

ThreadFix uses Black Duck's ProjectService to pull down application info as ProjectViews up to 2.8.3 version:

• Native Name: Name of the Project in Black Duck.

• Native Id: Name of the Project in Black Duck.

• Version URL: Versions URL pulled from ProjectView Meta Data.

The following call is used to fetch applications:

curl --location --request GET 'https://threadfixhub.blackducksoftware.com/api/projects' \
--header 'Authorization: Bearer {bearerToken-generated}' \
--header 'Accept: application/vnd.blackducksoftware.project-detail-4+json'

Fetching Versions

ThreadFix uses Black Duck's ProjectService to pull down application info as ProjectViews up to 2.8.3 version:

• Native Name: Name of the Project Version in Black Duck

• Native Id: Name of the Project Version in Black Duck

• Report URL: Vulnerable BOM Components URL pulled from ProjectVersionView Meta Data.
  

The following call is used to fetch versions:

curl --location --request GET 'https://threadfixhub.blackducksoftware.com/api/projects/{projectId}/versions' \
--header 'Authorization: Bearer {generatedAbove}' \
--header 'Accept: application/vnd.blackducksoftware.project-detail-4+json'

Fetching Scans & Scan Dates

ThreadFix uses Black Duck's ProjectService to pull down application info as ProjectViews up to 2.8.3 version:

When ThreadFix ingests the results they have their created and modified dates. This creates a new scan every time results are imported into ThreadFix using the lastScanDate as the Scan Date. This will update the current set of Black Duck vulnerabilities in the mapped ThreadFix Application. Vulnerabilities in different Versions of a Project in Black Duck will map to their corresponding vulnerability in previous versions, reopening them if they were reintroduced, closing them if they are no longer present or marking them false positive if they have been deemed so.

When attempting to upload a large amount of historical data from Black Duck into ThreadFix, it's heavily recommend to leverage Black Duck's Project Versions and ThreadFix's Remote Provider Mapping to introduce the results chronologically to avoid inaccurate results in the final data set.

As of version 2.8.4, ThreadFix no longer uses Black Duck's hub-common library to authenticate and pull application, version and vulnerability information. The following API call is now used to fetch scans:

curl --location --request GET 'https://threadfixhub.blackducksoftware.com/api/projects/{projectId}/versions/{versionId}/vulnerable-bom-components' \
--header 'Authorization: Bearer {generatedAbove}'

Parsing Vulnerabilities

ThreadFix parses the VulnerableComponentViews pulled from Black Duck into a Finding-Dependency pair. Most of the component information is stored in the VulnerableComponentView, while the vulnerability information is stored in the VulnerabilityWithRemediationView within it.

Dependency:

• CVE: If the Vulnerability Name pulled from the VulnerabilityWithRemediationView is a CVE, ThreadFix records it here.

• Component File Path: Component Version Origin Id pulled from the VulnerableComponentView. The value is a combination of the Origin, Component Name and Component Version.

• Component Name: Combination of the Componenet Name and Component Version Name pulled from the VulnerableComponentView.

• Description: Description pulled from the VulnerabilityWithRemediationView.

Finding:

• Native Id: Hashed together from Component Id, Component Version Id and Origin Id pulled from the Vulnerabilities URL stored in the VulnerableComponentView's Meta Data and the Vulnerability Name pulled from the VulnerabilityWithRemediationView.

• Severity Code: Rounded down Base Score pulled from the VulnerabilityWithRemediationView.

• Detail: Description pulled from VulnerabilityWithRemediationView.

• CWE: Not always included, but when available its pulled from CWE Id in the VulnerabilityWithRemediationView.

• Vulnerability Code: If a CWE Id is provided, it is used to catagorize the finding using ThreadFix's Generic Vulnerability table. If not present, it's catagorized as Configuration.

• Created Date: Remediation Created At date pulled from the VulnerabilityWithRemediationView.

• Modified Date: Remediation Updated At date pulled from the VulnerabilityWithRemediationView.

Vulnerability Statuses:

ThreadFix will not ingest findings with the following statuses, closing them if they were ingested in a previous scan:

• Patched

• Remediation Complete

• Mitigated

ThreadFix will mark findings false positive if they have the following statuses:

• Duplicate

• Ignored

ThreadFix will ingest all other status as an open finding.If you have any questions, please reach out to support@threadfix.it.