Skip to content

[K9VULN-5598] Add section for reachability analysis #29815

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Jun 9, 2025
Merged

[K9VULN-5598] Add section for reachability analysis #29815

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
62ca89e
Add section for reachability analysis
dastrong Jun 8, 2025
4df3103
Update wording per vale
dastrong Jun 9, 2025
a96d8b5
Fix quote
dastrong Jun 9, 2025
9c9a69a
Add more
dastrong Jun 9, 2025
e5b8c48
Update _index.md
cswatt Jun 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions .../en/security/code_security/software_composition_analysis/setup_static/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,6 +338,8 @@
datadog-ci sbom upload /path/to/third-party-sbom.json
```

## Features
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added this to split the setup sections with features of the product


### Link results to services
Datadog associates static code and library scan results with relevant services by using the following mechanisms:

Expand Down Expand Up @@ -402,6 +404,45 @@

**Note**: You must accurately map your Git provider teams to your [Datadog teams][16] for this feature to function properly.

### Reachability Analysis

Check warning on line 407 in content/en/security/code_security/software_composition_analysis/setup_static/_index.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.headings 

'Reachability Analysis' should use sentence-style capitalization.

Datadog provides static reachability analysis to help teams determine whether vulnerable code paths in dependencies are actually referenced within their application. This feature allows for more effective prioritization by identifying vulnerabilities that are statically unreachable and therefore unlikely to pose immediate risk.

Reachability analysis relies solely on static code analysis. Datadog examines the application’s call graph to determine whether any execution paths lead to vulnerable methods identified in supported advisories, without relying on runtime or dynamic execution data.

Check failure on line 411 in content/en/security/code_security/software_composition_analysis/setup_static/_index.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.quotes 

Use straight quotes instead of smart quotes.

Check notice on line 411 in content/en/security/code_security/software_composition_analysis/setup_static/_index.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.sentencelength 

Suggestion: Try to keep your sentence length to 25 words or fewer.

At this time, reachability analysis is supported only for Java projects, and is limited to a specific set of vetted security advisories. Vulnerabilities outside this set are not eligible for reachability determination.

#### Supported Advisories

Check warning on line 415 in content/en/security/code_security/software_composition_analysis/setup_static/_index.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.headings 

'Supported Advisories' should use sentence-style capitalization.

Static reachability analysis is currently available for the following advisories:

Check warning on line 417 in content/en/security/code_security/software_composition_analysis/setup_static/_index.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.tense 

Avoid temporal words like 'currently'.
- [GHSA-h7v4-7xg3-hxcc](https://osv.dev/vulnerability/GHSA-h7v4-7xg3-hxcc)
- [GHSA-jfh8-c2jp-5v3q](https://osv.dev/vulnerability/GHSA-jfh8-c2jp-5v3q)
- [GHSA-7rjr-3q55-vv33](https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33)
- [GHSA-2p3x-qw9c-25hh](https://osv.dev/vulnerability/GHSA-2p3x-qw9c-25hh)
- [GHSA-cm59-pr5q-cw85](https://osv.dev/vulnerability/GHSA-cm59-pr5q-cw85)
- [GHSA-qrx8-8545-4wg2](https://osv.dev/vulnerability/GHSA-qrx8-8545-4wg2)
- [GHSA-p8pq-r894-fm8f](https://osv.dev/vulnerability/GHSA-p8pq-r894-fm8f)
- [GHSA-64xx-cq4q-mf44](https://osv.dev/vulnerability/GHSA-64xx-cq4q-mf44)
- [GHSA-g5w6-mrj7-75h2](https://osv.dev/vulnerability/GHSA-g5w6-mrj7-75h2)
- [GHSA-xw4p-crpj-vjx2](https://osv.dev/vulnerability/GHSA-xw4p-crpj-vjx2)
- [GHSA-cxfm-5m4g-x7xp](https://osv.dev/vulnerability/GHSA-cxfm-5m4g-x7xp)
- [GHSA-3ccq-5vw3-2p6x](https://osv.dev/vulnerability/GHSA-3ccq-5vw3-2p6x)
- [GHSA-mjmj-j48q-9wg2](https://osv.dev/vulnerability/GHSA-mjmj-j48q-9wg2)
- [GHSA-36p3-wjmg-h94x](https://osv.dev/vulnerability/GHSA-36p3-wjmg-h94x)
- [GHSA-ww97-9w65-2crx](https://osv.dev/vulnerability/GHSA-ww97-9w65-2crx)
- [GHSA-8jrj-525p-826v](https://osv.dev/vulnerability/GHSA-8jrj-525p-826v)
- [GHSA-4wrc-f8pq-fpqp](https://osv.dev/vulnerability/GHSA-4wrc-f8pq-fpqp)
- [GHSA-4cch-wxpw-8p28](https://osv.dev/vulnerability/GHSA-4cch-wxpw-8p28)
- [GHSA-6w62-hx7r-mw68](https://osv.dev/vulnerability/GHSA-6w62-hx7r-mw68)
- [GHSA-2q8x-2p7f-574v](https://osv.dev/vulnerability/GHSA-2q8x-2p7f-574v)
- [GHSA-rmr5-cpv2-vgjf](https://osv.dev/vulnerability/GHSA-rmr5-cpv2-vgjf)
- [GHSA-4jrv-ppp4-jm57](https://osv.dev/vulnerability/GHSA-4jrv-ppp4-jm57)
- [GHSA-mw36-7c6c-q4q2](https://osv.dev/vulnerability/GHSA-mw36-7c6c-q4q2)
- [GHSA-hph2-m3g5-xxv4](https://osv.dev/vulnerability/GHSA-hph2-m3g5-xxv4)
- [GHSA-j9h8-phrw-h4fh](https://osv.dev/vulnerability/GHSA-j9h8-phrw-h4fh)

Datadog will continuing to expand support for additional advisories and ecosystems in future releases.

Check warning on line 444 in content/en/security/code_security/software_composition_analysis/setup_static/_index.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.tense 

Avoid temporal words like 'will'.

[1]: /security/code_security/software_composition_analysis/
[2]: https://app.datadoghq.com/security/configuration/code-security/setup
[3]: /security/code_security/software_composition_analysis/setup_static
Expand Down
Loading