Checkmarx和OWASP依赖项检查

Question

We are creating a delivery pipeline for our project. And we have checkmark scan as part of our pipeline.

We would like to know if dependency check is already done as part of checkmark scan or do we need to add OWASP dependency check seperately as part of our pipeline?

Answer 1

No, Checkmarx has an alternative to DependencyTrack, and they also support scanning open source dependencies. This cost some more money, ask them directly. To use dependency check, you'll have to do that in a separate part of the pipeline.