Import VEX from Files & Suppliers
Your suppliers already assess the vulnerabilities in the components you consume. Importing their VEX documents means you do not repeat that analysis — DevGuard turns every incoming statement into a VEX rule scoped to your repository.
Upload a VEX file
Use this for a one-off document, or for VEX your own build pipeline produces.
- Navigate to Dependency Risks → VEX Rules.
- Click Add a VEX-File or VEX-URL.
- Choose Upload a VEX File.
- Drop or select a single
.jsonfile. - Click Upload VEX.
Add an upstream source URL
Use this when a supplier publishes VEX continuously. You configure the URL once and DevGuard re-syncs it.
- On the VEX Rules page, expand Upstream VEX sources and click Add source (or use Add a VEX-File or VEX-URL → Supply a source URL).
- Pick the tab matching the document type:
- Click Add VEX source.
The source appears in the list with a type badge and its URL. Sync all sources triggers an immediate fetch of everything configured; otherwise DevGuard re-syncs on its own schedule as part of the repository's regular processing.
What DevGuard does with an incoming document
- Detects the format from the document's structure — CycloneDX, CSAF or OpenVEX.
- Identifies the affected products and reconstructs the dependency path each statement refers to. CSAF's product relationships yield an exact path; CycloneDX and OpenVEX statements produce a wildcard path ending in the affected component.
- Translates the status into a DevGuard decision:
| Format | Incoming status | Becomes |
|---|---|---|
| CSAF | known_not_affected | False positive |
| CSAF | known_affected with a no_fix_planned remediation | Accepted risk |
| CSAF | known_affected without that remediation, fixed, under_investigation | ignored |
| CycloneDX | false_positive, not_affected | False positive |
| CycloneDX | exploitable + response update, in_triage, will_not_fix | ignored |
| OpenVEX | not_affected | False positive |
| OpenVEX | affected | Accepted risk |
| OpenVEX | fixed, under_investigation | ignored |
- Creates one rule per statement, with the supplier's URL (or
vex-upload) as the rule's source, and the supplier's textual justification as the rule's justification. - Applies the rules to matching vulnerabilities and recalculates risk.
How re-syncing behaves
Each sync reconciles the rules for that specific source against the document as it stands now:
- A statement that is unchanged produces no change — rule identity is derived from the expression, so imports are idempotent.
- A new statement creates a new rule and is applied immediately.
- A statement that disappears from the document causes its rule to be deleted. The vulnerabilities it handled revert — see Delete a rule.
Rules from other sources, and your own rules, are never touched by another source's sync.
Take ownership of a synced rule
Editing a synced rule converts it into your own rule, detaching it from the upstream source. Later syncs no longer overwrite or remove it. Use this when a supplier's assessment is right in substance but you want to record your own reasoning, or narrow the expression.
Paranoid Mode
If you do not fully trust an upstream supplier, enable Paranoid Mode in Repository Settings:
Do you trust your upstream supplier? If not, enable this mode so you need to accept the statement vulnerability assessment in the VEX reports from your supplier manually.
With Paranoid Mode on, rules created from uploads and upstream sources are stored inactive — they do not change any vulnerability's state until you approve them. Rules you write yourself are always active, regardless of the setting.
Working from the CLI
The DevGuard scanner can upload a VEX document from a pipeline:
Use --origin to label where the document came from, so its rules are distinguishable in the rules table.
See the scanner VEX command reference for the full flag list and
Upload VEX for the container-based invocation.
Related Documentation
- Create & Manage VEX Rules — what imported rules become
- Sync External Vulnerability Data — SBOM ingestion, source precedence and the full lifecycle
- Export & Publish VEX — the other direction, for your own consumers
- CSAF & VEX Standards — how the three formats differ
- Upload VEX — the scanner-based upload in a CI pipeline