HI @Lieven Cardoen (Community Member)​ ,

Veracode Software Composition Analysis Upload & Scan (happens automatically upon Veracode Static Analysis scan) detects third party components by reviewing the uploaded artifacts. We have indexed a variety of databases for each technology (chief among these for Java is Maven Central and for .NET this is NuGet) and if we detect that the component matches one from these databases we will list it there.

If you are using components from a commercial vendor (such as Telerik or Infragistics) it is possible that we are not indexing their database (this may differ by technology and whether the vendor allows).

You may also wish to consider analysing the application with Veracode Software Composition Analysis Agent Based Scanning ( https://docs.veracode.com/r/c_sc_what_is ) which offers improved ability to detect third party components by integrating with the package manager.

If you'd like us to review further I would recomment creating a support case. Here's how you can log a case:

1. Navigate to the upper right corner of any page in the Community, click on your user avatar.

2. Select Contact Support from the drop-down menu.

In this please note the URLs for the .NET and Java scan from the Veracode Platform (http://(web.)analytics.veracode.com/... ), which components you are concerned about and where you are retrieving the components from.

Thank you,

Boy Baukema

Hi, thx for the answer. I certainly will check the Veracode Software Composition Analysis Agent Based Scanning. However, we are using a Progress ABL application that uses third party Java and .NET Components. So to build the .NET and Java components we do use Visual Studio (.NET) and Maven (Java) but I really wanted to scan the whole application. And the whole application is actually starting from Progress ABL that uses .NET and Java components. So to 'assemble' the application, we don't use NuGet or Maven. Sort of. Hard to explain our case.

I'll create a support case.

Kind regards, Lieven Cardoen