OWASP Dependency Track Dashboard is empty !!!

[khopithan]

Hi all, am new to Dependency Track and I was managed to configure it and set it up with SecOps pipeline. I have few Node JS test projects configured in Dependency Track which shows Vulnerabilities but the Dashboard and Portfolio is empty. So, can someone provide any idea to sort this out?

I have used below shown commands to install Cyclonedx tool for npm, generate SBOM file and and upload it into Dependency Track.

npm install --global @cyclonedx/cyclonedx-npm

cyclonedx-npm --ignore-npm-errors --output-file test_sbom.json package.json

curl -X POST http://localhost:8081/api/v1/bom -H "Content-Type:multipart/form-data" -H "X-API-Key:odt_000000000000000000000000000" -F "project=12121212121212121212" -F "bom=@test_sbom.json"

Regards,
Khopi

[khopithan]

Hi @nscuro, I have seen that you have contributed a lot for Dependency track so you are the one who can give an idea to sort out my above mentioned issue. Thanks in advance.

[khopithan]

I tried to validate SBOM file using couple of tools and got this output.

1. sbom-utility tool

./sbom-utility validate --input-file /path/my_sbom-Copy.json --variant my-test-sbom --format json

Welcome to the sbom-utility! Version v0.17.0 (sbom-utility) (linux/amd64)
[INFO] Loading (embedded) default schema config file: config.json...
[INFO] Loading (embedded) default license policy file: license.json...
[INFO] Attempting to load and unmarshal data from: /path/my_sbom-Copy.json...
[INFO] Successfully unmarshalled data from: /path/my_sbom-Copy.json
[INFO] Determining file's BOM format and version...
[ERROR] schema not supported: schema variant not found in configuration: Schema Format: CycloneDX, Version: 1.6, Variant: test-auth-sbom
[INFO] document /path/my_sbom-Copy.json: valid=[false]

And these are the schema list that sbom-utility tool has

./sbom-utility schema list

Welcome to the sbom-utility! Version v0.17.0 (sbom-utility) (linux/amd64)
[INFO] Loading (embedded) default schema config file: config.json...
[INFO] Loading (embedded) default license policy file: license.json...
[INFO] Scanning document for vulnerabilities...

name variant format version file url

CycloneDX v1.6 (latest) CycloneDX 1.6 schema/cyclonedx/1.6/bom-1.6.schema.json https://raw.githubusercontent.com/Cy cloneDX/specification/master/schema/bom-1.6.schema.json

CycloneDX v1.5 (latest) CycloneDX 1.5 schema/cyclonedx/1.5/bom-1.5.schema.json https://raw.githubusercontent.com/Cy cloneDX/specification/master/schema/bom-1.5.schema.json

CycloneDX v1.4 (latest) CycloneDX 1.4 schema/cyclonedx/1.4/bom-1.4.schema.json https://raw.githubusercontent.com/Cy cloneDX/specification/master/schema/bom-1.4.schema.json

CycloneDX v1.4 custom CycloneDX 1.4 schema/test/bom-1.4-custom.schema.json

CycloneDX v1.3 (latest) CycloneDX 1.3 schema/cyclonedx/1.3/bom-1.3.schema.json https://raw.githubusercontent.com/Cy cloneDX/specification/master/schema/bom-1.3.schema.json

CycloneDX v1.3 custom CycloneDX 1.3 schema/test/bom-1.3-custom.schema.json

CycloneDX v1.3 strict CycloneDX 1.3 schema/cyclonedx/1.3/bom-1.3-strict.schema.json https://raw.githubusercontent.com/Cy cloneDX/specification/master/schema/bom-1.3-strict.schema.json

CycloneDX v1.2 (latest) CycloneDX 1.2 schema/cyclonedx/1.2/bom-1.2.schema.json https://raw.githubusercontent.com/Cy cloneDX/specification/master/schema/bom-1.2.schema.json

CycloneDX v1.2 strict CycloneDX 1.2 schema/cyclonedx/1.2/bom-1.2-strict.schema.json https://raw.githubusercontent.com/Cy cloneDX/specification/master/schema/bom-1.2-strict.schema.json

SPDX v2.3 (latest) SPDX SPDX-2.3 schema/spdx/2.3/spdx-schema.json https://raw.githubusercontent.com/sp dx/spdx-spec/development/v2.3/schemas/spdx-schema.json

SPDX v2.3.1 development SPDX SPDX-2.3 schema/spdx/2.3.1/spdx-schema.json https://raw.githubusercontent.com/sp dx/spdx-spec/development/v2.3.1/schemas/spdx-schema.json

SPDX v2.2.2 (latest) SPDX SPDX-2.2 schema/spdx/2.2.2/spdx-schema.json https://raw.githubusercontent.com/sp dx/spdx-spec/v2.2.2/schemas/spdx-schema.json

SPDX v2.2.1 2.2.1 SPDX SPDX-2.2 schema/spdx/2.2.1/spdx-schema.json https://raw.githubusercontent.com/sp dx/spdx-spec/v2.2.1/schemas/spdx-schema.json

2. cyclonedx-cli

./cyclonedx-linux-x64 validate --input-file /path/my_sbom-Copy.json

BOM validated successfully.

so now, I am trying to find an alternative way to generate SBOM.

[simonirwin-r7]

@khopithan You haven't given any context as to whether you have other project SBOMs that look ok in the dashboard. I think you should get a sample SBOM file (perhaps from https://github.com/CycloneDX/bom-examples) and upload it to your Dependency Track instance. This could act as a baseline.

It would also help if you looked at any log messages from the API server and provided that kind of information.

[khopithan]

Hi @simonirwin-r7, Thank you and sorry for the delayed response. I have used sample SBOM that you shared and created a project. Actually I created multiple projects manually and via CI/CD pipeline as well where I can see all the vulnerability details without any issue but my concern is why is the below shown dashboard is empty even though my projects has critical and severe vulnerabilities?

[khopithan]

I fixed this issue by disabling ad blockers in my browser