Likelihood to Recommend If you are using a lot of open-source libraries, which is most likely, this is a must-have to ensure no known vulnerabilities slip into production
Read full review Onapsis is divided into 4 major components,
Assess Comply Defend Control In assess, it does a whitebox and blackbox testing of the ERP systems that have been added to the Onapsis console. It highlights relevant application issues and automates the process, also provides the solutions to implement the fix. In comply, it provides a governance on the various regulatory compliances which the firm has to follow, as well as provides a firm grip to the audit and ERP admin team. In control, it enables a workflow of 15 pre-defined parameter values within the SAP system and helps monitor, and track the changes made to those parameters. The capabilities are to either block, or request for an approval for changes made to those parameters in addition to just monitoring them. In defend, it goes through the SAP logs; and compares it with a pre-defined ruleset to alert the end-users via email or SIEM tool or both.
Read full review Pros Quick inventory scan: Black Duck helps us scan the code repositories in no time. And quickly list the components and I now really know what is in my code. Security and License risk management: Black Duck being rich in its knowledge base about the vulnerabilities and license issues of open source components, quickly compares the identified inventory to the Black Duck knowledge base and lists all the vulnerabilities and license issues in the code. Integration for automatic scanning: Black Duck is part of devops which provides us automatic scanning. Black Duck is not just for devops but also SecOps. Read full review Eliminating the manual process improves the overall accuracy of results and also frees up valuable resources to focus on other different projects. Onapsis provides great leverage to our technical teams in order to review in a standardized way of the landscape. Onapsis always matches vulnerabilities with useful context and finds possible solutions. Onapsis is usually implemented to continuously monitor, and alert us on any issues on the SAP systems. Not only this but implementing Onapsis also eliminates the network on the year-end and month-end audits and helps in making the overall process faster, smooth, efficient as well as accurate. Read full review Cons License model based on usage is costly. Documentation is extensive, but often confusing. Black Duck Hub could use some feature improvements for more robust governance capabilities Read full review Multiple UIs No proper customization of UI log-off Tedious setup of Control component No proper error messages received Read full review Support Rating Support seems very responsive.
Read full review Alternatives Considered Black Duck is an obvious choice, with its versatility, integration, best enterprise support and on top of the list the knowledge base Black Duck has. Vega or Grabber also scans the application and tells about vulnerabilities. But it can never be compared with the feature set of Black Duck. Black Duck can also generate reports.
Read full review Honestly, I havent use something like Onapsis before and currently I am not aware if there is something similiar out there. They are one of a kind and is a complete suit, so is unlikelly that someone from outside will appear with a better solution.
Read full review Return on Investment It is hard to measure ROI since Black Duck Hub saves us from costly legal battles that have thankfully never had to happen. Read full review It offers very reasonable packages. The customer support of Onapsis is reliable and efficient. It is a great platform as it shows a unified and easy-to-read different and complex topics in a simpler way. Read full review ScreenShots Black Duck Software Composition Analysis (SCA) Screenshots