Erkennen, priorisieren und
beseitigen Sie Open Source
Software-Risken in Ihrem gesamten SDLC

Yes. Just as Artifactory is part of the JFrog platform, Xray is another member of the JFrog Platform. This is why Artifactory and Xray work hand in hand and there is immense metadata that gets shared between both the products, which is not only how you can understand the problem, but also the scope of the problem when it comes to the scans that Xray does.

You have Xray if your subscription is Pro-X or above (EnterpriseX or Enterprise+)

Among many things that Xray supports, the most popular ones are: Docker, Maven, Pypi, Npm, Nuget, etc. However, there are many others. Xray is very universal in nature, just the way Artifactory is, which is how you can not only store all these different package types in one place, but you can also run scans periodically in order to find out if you are exposed to any unknown risks due to open source usage.

Yes. It can scan deeply and recursively to find out all of the different layers an image is made of and can understand all the components each layer can be made of. This is how you can get an exhaustive list of all the different dependencies being used. In addition, thereafter, you can also find out which of those could be violating any existing policy conditions.

Yes. It can run scans on your images as well as built artifacts that get uploaded to Artifactory. In addition it can capture metadata of the build process itself (build info) you can then publish this back to the JFrog platform and then run scans from the build info. This is how you can comprehensively cover all of the dependencies that took part in the particular build and understand what kind of risk you may have been exposed to.

All of the popular IDEs that are typically used by developers nowadays are supported by Xray’s shift left approach, which includes plugins for the following: VS Code, IntelliJ, Visual Studio, PyCharm, etc.

Yes, Xray definitely supports multiple policies. In fact many of our existing customers do have multiple policies, which can then be enabled on multiple repositories. This way you are comprehensively covering all of the important repositories that you have in mind, along with the important policies you have created upfront, so that you are catching the issues as they occur, which is highlighted by Xray.

Yes, it happens automatically and typically once a day. However, when there are security incidents, we do make sure we roll out as many updates as possible as we keep learning more and more about the incident, so that our users are equally equipped with dealing with the latest security incident on that given day.