XRAY: All About Xray Databases

AMongoDBincludes the following:

1. Vulnerabilitiesretain information about vulnerabilities and components (not artifacts – components can have several files)
2. Watchesare an identity that defines the scope of the resources you want to watch
3. Policiesare an identity that enforces security and license compliance behaviors
4. Components, which come from outside, extra metadata and information on components (e.g., who created the component, when was it last updated, etc.)

APosgreSQLholds file data. Duringindexing, all data is saved on the PostgreSQL database. This includes indexed components, component IDs, and checksums. Xray verifies if amatchexists between a givenvulnerabilityand a givencomponenton the components table. If a match is flagged, it triggers aviolation.

From version 3.x of Xray, all the information which was previously saved on MongoDB has been migrated to PostgreSQL.

RabbitMQis quite different than the rest of the databases, as itholds and managesall of Xrays messages in queues. This includes, for example, events that are being sent from Artifactory instances, indexing artifacts that are being downloaded from Artifactory, processing persist information to the database, and analyzing messages (i.e., scanning or sending notifications that are part of the analyzing process).

Published: July 24, 2018

Last updated: May. 31, 2021