Build JFrog configurations
Before software package and vulnerability data from JFrog can be analyzed in DevOps Intelligence , you must configure JFrog as a tool for the application and onboard the associated Technical Service. This process enables DevOps Intelligence to collect software package inventory and vulnerability information from JFrog repositories and artifacts.
The setup consists of two main tasks:
- Configure the JFrog tool for the application by adding a Software Package tool configuration in the Build phase.
- Onboard a Technical Service associated with the application to define the JFrog repository and artifacts that DevOps Intelligence should monitor.
Once the configuration and onboarding are complete, DevOps Intelligence automatically synchronizes software package and vulnerability data from JFrog.
Setting up Tool application configurations from JFrog
To onboard software package data, users need to edit the tool configuration for the application and then onboard the associated Technical Service.
Follow this path the edit the tool application configuration from Jfrog:
- From the Kyndryl Bridge main menu
, go to Services → Platform Services → Toolchain & Pipeline → DevOps Intelligence → Settings & Utilities → Application Configurations
- Select the application you want to configure and expand it to display the following sections:
- DevOps Phase
- Tools Configured
- Tools Having Technical Services
- Click the ellipsis (...) and select Edit Tool Configuration.
- On the Edit Configurations page, locate the Build phase and click Add Tool Configuration.
- On the Edit Tool Configuration page, configure the following:
- Build Category: Software Package
- Tool Engine: JFrog
- Ensure that the Tool Category Out-of-the-box is checked, this because software package and vulnerability data is collected from JFrog.
- Review the available mappings for:
- Release Format (can be modified if required).
- Severity: Critical, High, Medium, and Low.
- Package Status: Allowed, Denied, Need Approval, and Uncategorized.
- Click Add Configuration, then select Next.
- Click Submit to save the configuration.
Once saved, the Software Package tool is added to the application and the configured tool should appear as JFrog under the application's configured tools.
Onboard Technical Service from JFrog
After configuring the tool applications, users need to onboard a technical service to enable DevOps Intelligence to collect software package and vulnerability data from JFrog.
Follow these steps to onboard a Technical Service for a Software package:
- Identify the application, click the ellipsis (...), and select Onboard Technical Service.
- On the Onboard Technical Service page, configure the following settings:
- DevOps Phase: Build
- Build Category: Software Package
- Tool Engine: JFrog
- Connection: Select the JFrog connection.
- Repository: Select the repository containing the artifacts to be onboarded.
- Artifacts: Select the artifacts for which package and vulnerability data should be collected.
- Click Onboard.
After the onboarding request is submitted, DevOps Intelligence begins synchronizing software package data from the selected JFrog repository and artifacts.
Once synchronization is complete, package and vulnerability information becomes available in the Software Packages dashboard, where users can analyze package inventory, review vulnerability details and identify the applications and technical services affected by vulnerable packages.