Package Dependency Graph

Prisma Cloud’s Investigate feature offers a Package Dependency graph. This graphical representation of your SBOM allows you to explore package dependencies in your code repositories through the Simple Mode Query builder. You can investigate both transitive and intransitive packages, including their licenses and vulnerabilities.

Requirement: To use the graph, you must first enable the CAS SCA module. For more information on SCA licenses, refer to Prisma Cloud License Types.

Query Example

Find all code repositories that import packages infected with the CVE-2017-20165 vulnerability through package files.

1. Select Investigate on the Prisma Cloud console.
2. Select Application Asset from the Select a Query Type field.
3. Under Type, select VCSRepository, which represents a repository.
4. Add clauses:

   1. Click + Add > That Contains PackageFile.
   2. Click + Add > That Depends On Package.
   3. Click + Add > That Has Vulnerability.
   4. Click + Add > id > is > CVE-2017-20165.

      The query results are displayed as a graphical representation.

      

Legend

• Numbers next to the VCS Repository node: represent the grouping and amount or repositories containing the package file
• Numbers next to the PackageFile node: represent the grouping and amount of package files depending on the package
• Numbers next to the Package node: represent the grouping and amount of packages including the CVE vulnerability
• The edges describe the relationships between the nodes
• Clicking on a number expands the node, allowing you to drill-down for additional details by clicking on each child entity
• Clicking on a vulnerability displays its details, such as severity, CVSS score, impacted stages and more

A link icon on an edge denotes indirect dependencies. Click on the icon to view details of the indirect dependency between a package file and its package.