Schedule vuln-analysis task to avoid consuming sonatype credits to fast

[RenoV8-tls]

Hello @nscuro

Version: Dependency-Track v5.0.2

Question concerning the vuln-analysis task. My dependency-track is growing fast with multiple projects, oss index analyzer is used to perform these analysis and consume more and more credits as the portfolio is growing.

• Is it possible to schedule this task following this structure : dt.task.vuln-analysis.cron=30 3 */3 * * (eg. every 3 day) ?
• Is the vuln-analysis task the only one that make sontaype api calls ?

[nscuro]

I'd recommend you increase the cache TTL for OSS Index results instead: https://dependencytrack.github.io/docs/next/reference/configuration/properties/#dtcachevuln-analyzeross-indexresultsttl-ms. The default is 24h.

That allows the internal analyzer to still run at least daily. If you only scan every 3 days you'll have a very long delay between vulnerabilities being published and you being notified about them. Increasing the cache TTL for OSS Index specifically limits that staleness window to OSS Index only.

In either case you're making a tradeoff that increases the time until you notice new vulnerabilities. If you want to continue using OSS Index, Sonatype's intended way forward is to pay for credits.

[RenoV8-tls]

Understood thanks for the fast answer

In case do you confirm that it is possible this way dt.task.vuln-analysis.cron ?