Office Hours Q&A

Office Hours
1

Customers who have follow-up questions from Office Hours can add them here by replying to this thread.

2

I attended today’s office hours however I could not stay past 10:30 as I had a hard stop. I have the following question. We have been using the Nexus Lifecycle CycloneDx SBOM API to retrieve the Component and the Vulnerability information from Nexus Lifecycle. The Component data that is returned also has the License information. However, we do not see the License Threat Group in the data that is returned from that API. Is there a way to get the License Threat Group information as well using the SBOM or any other API?

3

Hi Prashant,

You can use the REST Report API to get the License Threat Groups for the effective license set. If you have the Advanced Legal Pack, and you need more detailed information, you can use the License Legal API to get the LTG on a per license basis in addition to a complete breakdown of multilicenses along with other legal information.

Example of the license data from the rest report API:

"licenseData": {
"declaredLicenses": [
{
"licenseId": "EPL-1.0",
"licenseName": "EPL-1.0"
},
{
"licenseId": "EDL-1.0",
"licenseName": "EDL-1.0"
}
],
"observedLicenses": [
{
"licenseId": "EPL-1.0",
"licenseName": "EPL-1.0"
},
{
"licenseId": "BSD-3-Clause",
"licenseName": "BSD-3-Clause"
}
],
"effectiveLicenses": [
{
"licenseId": "EPL-1.0",
"licenseName": "EPL-1.0"
},
{
"licenseId": "EDL-1.0",
"licenseName": "EDL-1.0"
},
{
"licenseId": "BSD-3-Clause",
"licenseName": "BSD-3-Clause"
}
],
"overriddenLicenses": [],
"status": "Open",
"effectiveLicenseThreats": [
{
"licenseThreatGroupName": "Weak Copyleft",
"licenseThreatGroupLevel": 2,
"licenseThreatGroupCategory": "moderate"
},
{
"licenseThreatGroupName": "Liberal",
"licenseThreatGroupLevel": 0,
"licenseThreatGroupCategory": "no-threat"
}
]
},
4

Hi Dgriffin! Thanks! I think this will work for us!