Out of the dlls and jars shown in the BinaryLibraries.csv file that was uploaded as part of the application scan, only a single dll which was detected via physical file scan is appearing for an application. The other dlls and/or jars are not appearing in the SCA results.
Details
If the binaries in the application is internal to your organization, it won't be shown in SCA, as it won't return anything, if searched against the SCA database.
Those that are found (displayed in SCA results are the ones which are present in the SCA database).
The component fingerprint needs to match our database for it to show up and internal components will not match.
Also, they would only be reported in the section "Additional Components with partial information"that is if there were components found in framework files that Highlight could not identify (framework.validated.csv).
For more details please refer: How Open Source component detection works
Additional Resources
CAST Highlight Troubleshooting Guides
CAST Highlight Product Documentation
Zendesk Ticket Number
48744
Comments