Project Inventory Details Pane

The header on the Project Inventory Details pane shows buttons that enable you take actions on the inventory item and lists attributes about the item and its associated component.

Click to open the Edit Inventory dialog where you can update inventory attributes. See for Editing Inventory from the Project Inventory Tab details.

A simple three-segment graph representing the Confidence level (High, Medium, or Low) of the inventory item. The Confidence level is the measure of the strength of the discovery technique used to generate the inventory item. The graph shows three shaded segments for High confidence, two for Medium, and one for Low.

For more information about the Confidence levels, see Inventory Confidence in the “Using Code Insight” chapter.

A bar graph showing the count of known vulnerabilities by severity color for the component associated with the inventory item. Click the graph to view the list of vulnerabilities and their details. For details about the graph and vulnerabilities in general, see Security Vulnerabilities Associated with Inventory.

If no vulnerabilities have been found for the inventory item, the value No is displayed in place of the graph.

The status of the inventory item:

The name of the inventory item. This attribute can be updated on the Edit Inventory dialog (see Editing Inventory from the Project Inventory Tab).

The URL of the license for this inventory item. You can click the URL link to open the component website.This attribute can be updated on the Edit Inventory dialog (see Editing Inventory from the Project Inventory Tab).

The property indicating whether the third-party component or artifact represented by the inventory item known third-party dependency in your code before it was discovered by the scan or you. The value is either Yes or No.

This field is used most often by analysts to denote information about the state of the inventory item.

This attribute can be updated on the Edit Inventory dialog (see Editing Inventory from the Project Inventory Tab).

The property notifying you whether or not security vulnerability alerts exist for this item. If alerts exist, click the x Open Alerts or x Closed Alerts link to view their details. If no alerts exist, None is displayed. You can open the Alerts dialog from this pane to change the status or priority of an alert. For more information, see Managing Security Vulnerability Alerts.

The URL link or a plain text reference (such as a Jira issue number) to request data pertaining to this inventory item in your site’s external workflow system. The link enables the reviewer to easily access the workflow data that tracks the status of open tasks for the inventory item. (The plain text reference still helps the reviewer locate the appropriate data in the workflow system.)

You can define this attribute when you edit or manually create an inventory item from the Analysis Workbench or the Project Inventory tab.

If no URL or reference has been defined, the value is None.

If additional request-related details are available for this inventory item, the icon is displayed next to the URL. Click the icon to open the Workflow Request Details window for a quick review of pertinent details about the request without having to access the workflow system.

Note:These details come from the specific external workflow system associated with your site. The details can vary based on your workflow system.

The name of the OSS or third-party component and internal ID, as identified in the Code Insight data library. You can associate the inventory item with a different component using the Edit Inventory dialog (see Editing Inventory from the Project Inventory Tab).

The external repository associated with the component. You can click the forge link to open the forge website.

Other licenses that can be associated with the component.

A bar graph showing the count of known vulnerabilities by severity color for the component. Click the graph to view the list of vulnerabilities and their details. For details about the graph and vulnerabilities in general, see Security Vulnerabilities Associated with Inventory.

If no vulnerabilities have been found for the inventory item, the value No is displayed in place of the graph.

The list of CPE names—from the National Vulnerability Database—that are mapped to the component. CPE (Common Platform Enumeration) is a structured naming scheme that includes the component’s vendor and product names in the following format:

cpe://<part>:<vendor>:<product> 

where <part> is either a (applications), h (hardware platforms), or o (operating systems).

Note that the data provided only represents the part, vendor and product; the version information is truncated from the CPE string.

The As-Found License Text field shows the license text or license references found in the scanned codebase. You cannot edit this field, but you can click Copy to Notices Text to copy the text to the Notices Text field. If content already exists in the Notices Text field, you can choose either to append the As-Found License Text content to the existing notices content or to replace the existing notices content.

The Notes & Guidance tab provides information about the automated and manual analysis of codebase as it relates to an inventory item.

Any notes added to the inventory item by the auditor or reviewer, based on findings during the analysis.

The Usage tab provides details on how your product uses the OSS or third-party software. You cannot update these items on the Usage tab, but you can update them on the Edit Inventory dialog (see Editing Inventory from the Project Inventory Tab).

The option indicating whether the item is part of the core product or an infrastructure piece such as a build or test tool. This can affect whether third-party notices are required for this item. The value can be Yes, No, or Unknown.

The option indicating whether code from the OSS or third-party package has been modified for use by your organization. The value can be Yes, No, or Unknown.