Windows vulnerability scanning

[ramizpolic]

Overview

The SBOM analyzer for Windows works and can collect details about user- and system- applications and updates. We should be able to perform vulnerability scanning on Windows-generated SBOM.

Windows vulnerability scanner can be implemented as a custom scanner plugin. Make sure to also add support for passing SBOM data from the Windows SBOM analyzer to the plugin.

[tomerse-sg]

can be very useful!
do you know if it is planned to be open source as well?

[ramizpolic]

Yup @tomerse-sg, all changes collected in our backlog tickets are changes that will be part of the open source codebase.

[tomerse-sg]

not sure it is accurate.
grype \ trivy doesn't know to find vulnerabilities for OS windows packages.. only .NET (in the open source version)

[ramizpolic]

will discuss this with the rest of the team on Monday and provide the details. thanks for addressing this @tomerse-sg

[tomerse-sg]

you can find some information on the challenge here

[ramizpolic]

we have discussed this and decided not to continue with it as it would require adding new services to the stack and extensive changes to our SBOM analyzer. if it's something you would like to use, feel free to create or contribute by writing a custom Windows Vulnerability Plugin scanner. the existing vulnerability scanning for Windows is good enough for us at the moment.