trying to compare with twistlock results

[networkandcode]

Hi,
we are at the moment using both Dependency check and Twistlock for scanning the build and container image respectively.

The tools tend to provide different results. I gathered the following data, after checking appropriate info at NIST.

scannedBy	CVE	v2Severity	v3Severity
dependencyCheck	CVE-2016-1000338	5	7.5
dependencyCheck	CVE-2016-1000344	5.8	7.4
dependencyCheck	CVE-2018-1000180	5	7.5
dependencyCheck	CVE-2016-1000352	5.8	7.4
dependencyCheck	CVE-2016-1000340	5	7.5
dependencyCheck	CVE-2018-1000613	7.5	9.8
dependencyCheck	CVE-2016-1000343	5	7.5
dependencyCheck	CVE-2016-1000342	5	7.5
dependencyCheck	CVE-2019-17571	7.5	9.8
dependencyCheck	CVE-2007-1652	7.5	null
dependencyCheck	CVE-2020-5411	6.8	8.1
dependencyCheck	CVE-2018-1258	6.5	8.8
prismaCloud	CVE-2018-10237	4.3	5.9

I was wondering if one of the tools were using CVSS Version2 and the other 3, but still there is some conflict in understanding. So trying to figure why twistlock showed only one CVE where as dependency check, a lot. FYI, We have configured dependency check to only fail those with CVSS >= 7.

update: seems Dependency check was picking everything, based on the HTML report.. need to see things related to Prisma cloud, such as configuration, plugin version etc.

[albuch]

I think this is quite difficult to answer without the actual Image that you are scanning and the Vulnerability Rule that you've set up in Prisma Cloud (formerly known as Twistlock) for this image as well as your dependency-check configuration. Are any of the findings of Dependency-Check false-positives, which build integration are you using and whats your configuration look like? This question would probably be better directed at Palo Alto Networks Support anyways.

From my personal experience Prisma Cloud tends to find fewer (though not as few as in your example) CVEs for Java as Dependency-Check but on a positive note comes with fewer false-positives as well. But that is a trade-off decision that every tool handles differently.