Dependency‑Track

"Dependency‑Track: Running a Vulnerability Management System for SBOMs"
SBOMs are easy to generate and hard to operationalize—especially when “visibility” turns into noisy dashboards and stalled remediation. This book is for experienced security engineers, platform operators, and senior developers who need Dependency‑Track to function as a dependable system of record: one that continuously ingests SBOMs, correlates vulnerabilities accurately, and drives real engineering action across many teams and releases.
You’ll build an end-to-end mental model of SBOM-driven vulnerability management—from producing and validating CycloneDX/SPDX SBOMs, to designing coherent project/version scoping, to running robust ingestion pipelines through an API-first automation approach. The book explains the Dependency‑Track domain model (projects, components, findings), then goes deep on correlation mechanics, debugging mismatch modes, and reducing noise through identity hygiene and disciplined exceptions. You’ll also learn how to implement scalable triage loops, write enforceable policies, choose enforcement points (CI, release gates, continuous monitoring), and deliver reporting that works for both engineers and executives.
Expect production-grade guidance: secure operations, access control and API key lifecycle, upgrade and compatibility planning, backup/restore as a true system-of-record requirement, and capacity planning under continuous ingestion. Familiarity with CI/CD, REST APIs, and modern software supply chain concepts is assumed.