Features and Capabilities

Learn how JFrog Xray covers security, licenses, SBOM, and policies.

Software Composition Analysis

JFrog Xray's Software Composition Analysis (SCA) capabilities analyze third-party components to identify and manage different types of risk throughout the software development lifecycle (SDLC).

Security Risk

Xray identifies vulnerabilities, malicious behavior, and emerging threats in open-source packages and dependencies.

Capabilities include:

JFrog Security Research: Continuously updated threat intelligence that identifies known and emerging supply chain threats.
Malicious Package Detection: Detects packages that exhibit suspicious or harmful behavior beyond known Common Vulnerabilities and Exposures (CVEs).
Detect Malicious AI Models: Identifies potentially harmful AI and machine learning models sourced from external repositories.
Vulnerability Detection (CVEs): Identifies known vulnerabilities across supported ecosystems.

For more information, see:

JFrog Security Research

Malicious Package Detection

Detect Malicious AI Models

Legal Risk

Xray analyzes open-source licenses to help you meet legal, compliance, and distribution requirements.

Capabilities include:

Custom Software Licenses: Define and manage custom or proprietary licenses.
License Conclusion: Determine the effective license of a component based on its contents.
License Attribution Report: Generate attribution reports for compliance and redistribution.

For more information, see:

Custom Software Licenses

License Conclusion

License Attribution Report

Operational Risk

Xray helps you identify non-security risks that can impact reliability, maintainability, and long-term support. These risks include end-of-life (EOL), deprecated, or unmaintained dependencies.

Capabilities include:

Operational Risk Analysis: Detect operational risks in repositories, builds, and release bundles based on package health and lifecycle signals.
EOL and Deprecation Detection: Flag components that reached end-of-life or are marked as deprecated.
Maintenance and Community Health Indicators: Identify components that haven't been updated in a long time or show low maintainer activity.
High-Impact Updates Awareness: Highlight major version changes that may introduce breaking changes or compatibility risks.
Operational Risk Policies and Violations: You can attach an operational risk policy to a watch. Scan results show the related operational risk data and violations.

For more information, see:

Operational Risk

Software Bill of Materials and Supply Chain Visibility

Xray provides a software bill of materials (SBOM) so you can see the components that make up your software and how risk propagates across artifacts and builds.

Capabilities include:

SBOM Generation and Analysis
SBOM Export and Sharing
Component and Dependency Relationships

For more information, see:

SBOM

SBOM Export

SBOM Import

Policies, Watches, and Enforcement

Xray enables governance and automated response to detected risks across the JFrog Platform.

Capabilities include:

Policies in JFrog Xray: Define rules for security, legal, and operational risk.
Watches: Scope policies to specific repositories, builds, or artifacts.
Violations Handling and Notifications: Track, notify, and respond to policy violations.
Ignoring Violations (Ignore Rules): Manage known or accepted risks.

For more information, see:

Policies in JFrog Xray

Watches in JFrog Xray

Violations Handling and Notifications

Ignoring Violations in JFrog Xray: Understanding Ignore Rules