Executing metrics update for project

[savujevi]

Hello,

what does "Executing metrics update for project" mean ?

Does it mean that if the vulnerability databases are update during the time, the different projects and their boms are checked again against new findings ?

Or does DT doesn't do this at all ?

Thank you for your help.

Best regards,
Sascha Vujevic

[stevespringett]

Project metrics calculate the number of vulnerabilities by criticality, number audited, policy violations, etc.

Refer to https://github.com/DependencyTrack/dependency-track/blob/master/src/main/java/org/dependencytrack/model/ProjectMetrics.java for the fields that are captured in project metrics.

[savujevi]

Thanks.

Does new vulnerabilities are shown on an existing project after a new import from e.g. Sonatype OSS Index was made or do I have to reimport the bomfile ?

Thanks.

[stevespringett]

DT will analyze the entire portfolio of components every 24 hours at a minimum and will update portfolio, project, and component metrics accordingly.