For general information & instructions on the use of Remote Providers within ThreadFix, please refer to this page's parent page: Remote Providers.

For information on REST API functionality for Remote Providers, please refer to the following: Remote Providers API

Introduction

Black Duck integrates with ThreadFix to automatically scan, identify and inventory open source software, allowing you to understand license obligations, conflicts and risks. As of version 2.6+, ThreadFix uses Black Duck's hub-common library to authenticate and pull application, version and vulnerability information.

Authentication

ThreadFix uses Black Duck's Access Token to authenticate and establish a connection with its service layer. This token is generated from Profile Page of the target Black Duck instance. 

Here's how to create your token:

1. Go to your Profile Page in Black Duck
   
   

2. Scroll to the bottom to find the User Access Token section.

3. Enter a name

4. Select at least Read access for the scope.

5. Click Generate
   
   

6. Copy the resulting API Token to Clipboard and Enter it into the Remote Providers section in ThreadFix.
   
   

Fetching Applications

ThreadFix uses Black Duck's ProjectService to pull down application info as ProjectViews:

• Native Name: Name of the Project in Black Duck.

• Native Id: Name of the Project in Black Duck.

• Version URL: Versions URL pulled from ProjectView Meta Data.

Fetching Versions

ThreadFix uses Black Duck's HubService to pull down version info as ProjectVersionViews:

• Native Name: Name of the Project Version in Black Duck

• Native Id: Name of the Project Version in Black Duck

• Report URL: Vulnerable BOM Components URL pulled from ProjectVersionView Meta Data.

Fetching Scans & Scan Dates

ThreadFix uses Black Duck's HubService to pull down vulnerabilities as VulnerableComponentViews:

While Black Duck ingests scans by uploading it's BOM files either manually or through it's Hub Scanner, it organizes those results using Projects and Versions. When ThreadFix ingests these results they have their created and modified dates, but are not attributed to a scan or scan date. This creates a new scan every time results are imported into ThreadFix using the current time as the Scan Date. This will update the current set of Black Duck vulnerabilities in the mapped ThreadFix Application. Vulnerabilities in different Versions of a Project in Black Duck will map to their corresponding vulnerability in previous versions, reopening them if they were reintroduced, closing them if they are no longer present or marking them false positive if they have been deemed so.

When attempting to upload a large amount of historical data from Black Duck into a ThreadFix, it's heavily recommend to leverage Black Duck's Project Versions and ThreadFix's Remote Provider Mapping to introduce the results chronologically to avoid inaccurate results in the final data set.

Parsing Vulnerabilities

ThreadFix parses the VulnerableComponentViews pulled from Black Duck into a Finding-Dependency pair. Most of the component information is stored in the VulnerableComponentView, while the vulnerability information is stored in the VulnerabilityWithRemediationView within it.

Dependency:

• CVE: If the Vulnerability Name pulled from the VulnerabilityWithRemediationView is a CVE, ThreadFix records it here.

• Component File Path: Component Version Origin Id pulled from the VulnerableComponentView. The value is a combination of the Origin, Component Name and Component Version.

• Component Name: Combination of the Componenet Name and Component Version Name pulled from the VulnerableComponentView.

• Description: Description pulled from the VulnerabilityWithRemediationView.

Finding:

• Native Id: Hashed together from Component Id, Component Version Id and Origin Id pulled from the Vulnerabilities URL stored in the VulnerableComponentView's Meta Data and the Vulnerability Name pulled from the VulnerabilityWithRemediationView.

• Severity Code: Rounded down Base Score pulled from the VulnerabilityWithRemediationView.

• Detail: Description pulled from VulnerabilityWithRemediationView.

• CWE: Not always included, but when available its pulled from CWE Id in the VulnerabilityWithRemediationView.

• Vulnerability Code: If a CWE Id is provided, it is used to catagorize the finding using ThreadFix's Generic Vulnerability table. If not present, it's catagorized as Configuration.

• Created Date: Remediation Created At date pulled from the VulnerabilityWithRemediationView.

• Modified Date: Remediation Updated At date pulled from the VulnerabilityWithRemediationView.

Vulnerability Statuses:

ThreadFix will not ingest findings with the following statuses, closing them if they were ingested in a previous scan:

• Patched

• Remediation Complete

• Mitigated

ThreadFix will mark findings false positive if they have the following statuses:

• Duplicate

• Ignored

ThreadFix will ingest all other status as an open finding.

If you have any questions, please reach out to support@threadfix.it.