• English

    • Importing vulnerability triage

    The Johnny CLI agent supports importing VEX vulnerability annotations. This allows you to transfer triage results from one project version to another or between projects. To import VEX vulnerability annotations, you need to add the --vex-file <vex file path> parameter to the command.

    Currently, only CycloneDX files are supported for importing VEX annotations.

    Then, during the scan, the CLI agent will look up the status for each detected vulnerability in the specified VEX file and, if found, include it in the scan results.

    It is important to note that vulnerabilities are linked to project dependencies.

    The PURL and vulnerability ID in the VEX file and the scanned project must match exactly.

    Example of a command to import VEX vulnerability annotations:
    ./johnny scan dir . \
--api_token <api_token> \
--api_url <api_url> \
--vex-file <cyclonedx file path>
    Was this page helpful?