JFrog Artifactory

Onboard JFrog Artifactory to authorize the Software Composition Analysis (SCA) scanner to resolve packages stored in your private Artifactory instance. By retrieving dependency metadata directly from the registry, the scanner can build accurate dependency trees and reliably detect vulnerabilities in your private libraries.

Integration scope

• SCA vs Image scanning: to build accurate dependency trees. It does not support container image scanning. To scan images, configure a separate JFrog Artifactory instance.
• You can onboard only one JFrog Artifactory instance. Within that instance, you can configure one integration for each supported package manager type

Supported environments

Supports both JFrog Artifactory Cloud (SaaS) and JFrog Artifactory Self-Hosted (On-Premises) environments.

IMPORTANT: Connectivity via Transporter over Broker VM is not supported.

Supported package managers

• Maven: Supports mirroring
• Gradle
• NPM: