Dependency Track not showing components (and vulnerabilities) for some SBOMs made with Syft

[morphmkd]

I'm using Dependency Track to monitor for vulnerabilities on multiple systems. I create an SBOM in CycloneDX 1.6 JSON format using Syft and then import the SBOM into Dependency Track. The problem is that for some systems I upload the SBOM and the system accepts it without complaining that something is wrong but then nothing happens. The component list just stays empty and nothing is shown.

For other systems doing the same works just fine.

Any ideas what could be wrong and how to troubleshoot?

[beat2]

I am just trying to use DependencyTrack for the first time, so it may or may not help you. But we hit a similar issue, for us just some components were loaded but not all. We checked the logs and it looks like we hit this issue: #2821

We found out checking the logs.

[ahmadalfy]

I don't think this is related to Syft as I am using Syft and a composer package to generate the SBOM. By default when I head to the components menu I get this

When I fill in some search criteria, it works (check the second input it has a letter a)

So, is this expected?

[mcvermeulen]

Same for me. If you go to the project and then select the components tab, you do see all.

[morphmkd]

As explained in the question, most of the times it works fine. I create the SBOM, import it into dependancy track and can see components and vulnerabilities. That same procedure done on some particular systems results in no components being shown under the project. Searching for components also doesn't work since they are not there.

[jsoule6]

As explained in the question, most of the times it works fine. I create the SBOM, import it into dependancy track and can see components and vulnerabilities. That same procedure done on some particular systems results in no components being shown under the project. Searching for components also doesn't work since they are not there.

This is the same behavior for me. I can see all the projects and vulnerabilities. When I go to the Component tab, it is blank by default. However, when I search for a component, it shows up. I am also using Syft to generate the SBOM.

[mreiche]

Same for me, I have components in the project, but not in the Components tab

[rroblik]

Hello, same for me. Any new about it ?

[Himan10]

Hey @ahmadalfy, have you found any solutions to this problem? I am encountering the same issue with my implementation of dependency track as well, data is present in the database but somehow it doesn't show components.

[ahmadalfy]

It doesn't show unless you search for something. I think this is how Dependency track handles it

[nscuro]

The "global" Components page is indeed intended to be more of a search, rather than a filterable list. There is not much value in displaying an unfiltered list of thousands of components.

However, judging by the confusion here, there are improvements to be made to make the intention more clear, e.g. by explicitly pointing out that a search needs to be performed first in order to see any records.

We're also planning to offer more / more flexible filtering options (#2919).

[ahmadalfy]

I think it's a source of confusion because it's what everyone expects from a listing. Or at least this is what years of working with different systems taught us how listings works.

Whatever the direction, acknowledging that X is a source of confusion is a great step towards finding a solution