Data Sources
Data Sources in OpsMx Delivery Shield defines the entry points from which security scanning is initiated — the what and where of every scan. Whether your team is scanning source code in a Git repository, a container image in a registry, a pre-existing SBOM file, or a mobile application artifact in JFrog Artifactory, Data Sources provides a unified, on-demand interface to trigger security analysis across all asset types from a single platform.
Data Source Types
Delivery Shield supports four primary Data Source types for Ad Hoc scanning:
Source Scan
What It Is
Source Scan is an on-demand security scanning capability for source code repositories hosted on platforms including GitHub, GitLab, Bitbucket, and others. It runs a configurable set of security tools — including Semgrep, Opengrep, and SonarQube — against selected repositories and branches to identify vulnerabilities, code quality issues, and compliance risks.
During project setup, users can link their source control account, enabling the system to automatically execute all eligible scans on selected repositories and branches. Once completed, the system generates detailed reports highlighting vulnerabilities, security risks, and compliance insights — and raises alerts based on findings with an overall risk status per repository or branch.
Source Scan brings multiple security scanners together under one roof — so teams get a complete security picture of their code without configuring and running tools individually.
Why Source Scan Is Used in OpsMx
Modern development workflows involve multiple repositories and rapid code changes — making it difficult to consistently enforce security and compliance checks across every branch and every team. Source Scan addresses this by:
Providing a unified interface to run multiple security scanners in one place — no tool-hopping
Offering quick visibility into vulnerabilities and overall risk posture per repository and branch
Reducing manual effort required to configure and run individual scanning tools
Ensuring better governance and compliance across all repositories regardless of team ownership
Automatically re-scanning repositories when new commits are detected — keeping results always current
Enabling teams to proactively identify and remediate security issues before deployment
Supported Scanners
How to Use — Source Scan
For Public Repositories: Users can directly initiate a scan without any integration. Provide the repository details and the system executes the scans immediately.
For Private Repositories: Users need to integrate their GitHub or Bitbucket account. Once connected, they can select repositories and branches and trigger scans.
Source Scan Results
Once a scan completes, results are available in the Reports page and include:
Vulnerability findings categorized by severity — Critical, High, Medium, Low
Risk status — overall risk score per repository and branch
Compliance insights — policy violations and governance gaps
Alerts — raised automatically based on findings that breach defined thresholds
Downloadable reports — exportable for audit, compliance review, or stakeholder sharing
Artifact Scan
What It Is
Artifact Scan is an on-demand security scanning capability for container images and artifacts stored in registries and artifact management systems. Users configure or connect their artifact source during setup and initiate scans on selected artifacts as needed.
Once a scan completes, the system generates detailed reports highlighting vulnerabilities, security risks, and compliance insights. Alerts are raised based on findings, and an overall risk status is provided for each scanned artifact — giving teams a clear picture of whether an artifact is safe to deploy.
Artifacts are the deployable units of modern applications. Artifact Scan ensures every container image or package is validated for security before it is released or deployed to any environment.
Why Artifact Scan Is Used in OpsMx
Artifacts represent the final, deployable form of an application. A vulnerable dependency or misconfigured image layer that passes code review can still make it into a container image — and from there, directly into production. Artifact Scan closes this gap by:
Providing a simple, unified way to scan artifacts on demand
Offering clear visibility into vulnerabilities and risk posture of every deployable asset
Reducing manual effort in validating artifact security across environments
Supporting governance and compliance requirements for released artifacts
Enabling teams to identify and remediate security risks before artifacts reach staging or production
How to Use — Artifact Scan
For Public Artifacts: Users can directly initiate a scan by providing the artifact reference — image name, tag, or package details — without requiring any registry integration.
For Private Artifacts: Users need to integrate their artifact repository or registry. Once connected, they can select and scan specific artifacts on demand.
Artifact Scan Results
Once a scan completes, results include:
CVE findings per image layer — with CVE ID, affected package, version, severity, and fix version
Risk status — overall security score per artifact
License information — open-source license compliance per dependency
SBOM output — generated automatically in CycloneDX or SPDX format
Alerts — raised automatically based on severity thresholds
Downloadable reports — exportable for audit, compliance, or deployment gate review
SBOM Scan
What It Is
Adhoc SBOM Scan allows users to upload a Software Bill of Materials (SBOM) file and scan it for known vulnerabilities and risks — without requiring access to source code or container images. The system analyzes the components listed in the SBOM and generates reports with identified vulnerabilities, alerts, and an overall risk status.
Why SBOM Scan Is Used in OpsMx
SBOMs provide a structured inventory of all components and dependencies in an application. Evaluating hundreds of components manually against vulnerability databases is time-consuming and error-prone. Adhoc SBOM Scan solves this by:
Quickly identifying vulnerabilities in all listed components — matched against NVD, OSV, and GitHub Advisory databases in real time
Providing immediate risk visibility without needing access to source code or running containers
Supporting security and compliance checks for third-party software — vendors, COTS applications, and open-source packages where only an SBOM is available
Enabling faster decision-making before deployment or procurement — assess a vendor's software risk from their SBOM alone
Supporting SEBI CSCRF, NIST 800-53, and other regulatory mandates requiring SBOM-based component risk assessment
SBOM Scan Results
Once scanning completes, results include:
Component-level vulnerability findings — CVE ID, severity, affected component, version, and fix version
License risk — license type per component flagged against your organization's policy
Overall risk status — aggregate risk score for the entire SBOM
Alerts — raised for components with Critical or High severity CVEs
Downloadable report — full findings for compliance review or vendor risk assessment
Mobile Artifact Scan (JFrog Artifactory)
The JFrog Artifactory Mobile Artifact Scan enables comprehensive security scanning of mobile application artifacts — specifically APK files — stored in JFrog Artifactory repositories. It integrates multiple specialized scanning engines — VirusTotal, Mobile App Security Scan (Mobile Security Framework), and SBOM generation — to provide malware detection, deep mobile security analysis, and complete component inventory for every scanned mobile artifact.
Note: This feature currently supports APK files only.
Why Mobile Artifact Scan Is Used in OpsMx
Mobile applications carry unique security risks that standard container or source code scanners are not equipped to detect — embedded malware, insecure permissions, hardcoded secrets, insecure API endpoints, and third-party SDK vulnerabilities. Before a mobile artifact is distributed or deployed, it must be validated against these mobile-specific threats.
Mobile Artifact Scan addresses this by:
Providing malware detection powered by 70+ antivirus engines via VirusTotal — catching threats missed by any single scanner
Running comprehensive mobile security analysis via Mobile App Security Scan — covering code vulnerabilities, permission risks, API security, and compliance checks
Generating a complete SBOM for every APK — mapping all embedded libraries, dependencies, and their known CVEs
Enabling automated, event-driven scanning — every new APK deployment in Artifactory triggers a scan automatically
Supporting organization-wide mobile artifact governance — scanning across single repositories or multiple repository groups
Benefits for the User
1. Scan Any Asset — Immediately, Without Pipeline Changes
All four Data Source types support on-demand scanning with no webhook configuration, no pipeline modification, and no DevOps involvement — security and compliance teams can initiate scans independently at any time.
2. Mobile-Specific Security — Purpose-Built for APKs
Standard container and source scanners cannot detect mobile threats. Mobile Artifact Scan combines VirusTotal's 70+ engine malware detection with Mobile App Security Scan's deep static and dynamic analysis — providing security coverage purpose-built for the unique threat surface of mobile applications.
3. Third-Party & Vendor Risk Assessment — No Source Code Needed
SBOM Scan and Mobile Artifact Scan both enable security assessment of software teams did not build — vendor applications, COTS products, and third-party mobile SDKs — from component inventory alone.
4. Unified Reports Across All Asset Types
Whether scanning source code, a container image, an SBOM file, or a mobile APK, all results land in the same Reports page in Delivery Shield — with consistent severity categorization, alert management, and download options.
5. Always Current — Automated Re-scanning on Changes
Source Scan re-scans on new commits, Artifact Scan detects new image tags, and Mobile Artifact Scan triggers automatically on every new APK deployment — ensuring security findings are never stale as assets evolve.
6. Complete Mobile Application Lineage
Mobile Artifact Scan generates a full SBOM for every APK — mapping all embedded libraries, SDKs, and their known CVEs — giving mobile security teams the same component-level transparency that container scanning provides for cloud-native applications.
7. Compliance Evidence — On Demand
All scan results are downloadable in report format — ready for regulatory submission, internal audit review, or deployment gate documentation across all four data source types.
Last updated