All Properties

Acceptable Values: BITBAKE, CARGO, CARTHAGE, COCOAPODS, CONAN, CONDA, CPAN, CRAN, DART, GIT, GO_MOD, GO_DEP, GO_VNDR, GO_VENDOR, GO_GRADLE, GRADLE, HEX, IVY, LERNA, MAVEN, NPM, NUGET, PACKAGIST, PEAR, PIP, PNPM, POETRY, RUBYGEMS, SBT, SETUPTOOLS, SWIFT, YARN, CLANG, XCODE, OPAM, UV, RUSH

Required Detect Types: The set of required detectors.

default: ALL

Acceptable Values: ALL, NONE, BITBAKE, CARGO, CARTHAGE, COCOAPODS, CONAN, CONDA, CPAN, CRAN, DART, GIT, GO_MOD, GO_DEP, GO_VNDR, GO_VENDOR, GO_GRADLE, GRADLE, HEX, IVY, LERNA, MAVEN, NPM, NUGET, PACKAGIST, PEAR, PIP, PNPM, POETRY, RUBYGEMS, SBT, SETUPTOOLS, SWIFT, YARN, CLANG, XCODE, OPAM, UV, RUSH

Detector Accuracy Requirements: Detector types from which HIGH accuracy results are required when a detector of that type applies.

default: NONE

Acceptable Values: NONE, BITBAKE, CARGO, CARTHAGE, COCOAPODS, CONAN, CONDA, CPAN, CRAN, DART, GIT, GO_MOD, GO_DEP, GO_VNDR, GO_VENDOR, GO_GRADLE, GRADLE, HEX, IVY, LERNA, MAVEN, NPM, NUGET, PACKAGIST, PEAR, PIP, PNPM, POETRY, RUBYGEMS, SBT, SETUPTOOLS, SWIFT, YARN, CLANG, XCODE, OPAM, UV, RUSH

Detector Types Excluded: By default, all Detector types will be included. To exclude specific Detector types, specify them via this parameter. Exclusion rules take precedence.

Detectors Excluded: By default, all Detectors will be included. If you want to exclude specific Detectors, specify the ones to exclude here. Exclusion rules take precedence.

Docker Passthrough: Additional properties may be passed to the docker inspector by adding the prefix detect.docker.passthrough to each Docker Inspector property name and assigning a value. The 'detect.docker.passthrough' prefix will be removed from the property name to generate the property name passed to Docker Inspector (with the given value).

DEPRECATED: Docker Inspector support is deprecated. This property will be removed in 13.0.0.

Docker Image Name: The Docker image name (repo:tag) to inspect.

DEPRECATED: Docker Inspector support is deprecated. This property will be removed in 13.0.0.

Docker Image ID: The ID (shown in the 'IMAGE ID' column of 'docker images' output) of the target Docker image. The target image must already be local (must appear in the output of 'docker images').

DEPRECATED: Docker Inspector support is deprecated. This property will be removed in 13.0.0.

Docker Inspector Path: Use this property to point Detect to a local Docker Inspector jar file, instead of the default Docker Inspector jar file that Detect downloads from the binary repository. You need to ensure the version is compatible (the same major version that Detect downloads by default).

DEPRECATED: Docker Inspector support is deprecated. This property will be removed in 13.0.0.

Docker Inspector Version: Version of the Docker Inspector to use. By default Detect will attempt to automatically determine the version to use.

DEPRECATED: Docker Inspector support is deprecated. This property will be removed in 13.0.0.

Docker Executable: Path to the docker executable (used to load image inspector Docker images in order to run the Docker Inspector in air gap mode).

DEPRECATED: Docker Inspector support is deprecated. This property will be removed in 13.0.0.

Platform Top Layer ID: To exclude components from platform layers from the results, assign to this property the ID of the top layer of the platform image. Get the platform top layer ID from the output of 'docker inspect platformimage:tag'. The platform top layer ID is the last item in RootFS.Layers. For more information, see 'Isolating application components' in the Docker Inspector documentation.

DEPRECATED: Docker Inspector support is deprecated. This property will be removed in 13.0.0.

default: false

Component Location Analysis Enabled: If set to true, Detect will save an output file named 'components-with-locations.json' in the Scan subdirectory detailing where in the project's source code OSS components are declared.

default: false

Component Location Analysis Status: If set to true, Detect status and exit code will be affected by the status of the Component Location Analysis run.

default: SOURCE

Acceptable Values: SOURCE, IMAGE

Detect Scan Mode: Informs detect of what is being scanned which allows improved user experience when scanning different types of targets.

default: false

Wait For Results: If set to true, Detect will wait for Black Duck SCA products until results are available or the detect.timeout is exceeded.

default: true

Follow Symbolic Links: If set to true, Detect will follow symbolic links when searching for detectors, when searching for files that select detectors (such as Bitbake and Sbt) need, when searching for directories to exclude from signature scan, and when searching for binary scan targets. Symbolic links are not supported for Impact Analysis.

default: false

Correlated Scanning Enabled: When enabled, Detect activates the Black Duck SCA correlated scanning capability to enhance match accuracy.

default: 1

Detect Parallel Processors: The number of threads to run processes in parallel, defaults to 1, but if you specify less than or equal to 0, the number of processors on the machine will be used.

default: false

Detect Ignore Connection Failures: If true, Detect will ignore any products (eg. Black Duck SCA) that it cannot connect to.

default: false

Force Success: If true, Detect will always exit with code 0.

Go Executable: Path to the Go executable.

default: NONE

Acceptable Values: NONE, UNUSED, VENDORED

Go Mod Dependency Types Excluded: Set this value to indicate which Go Mod dependency types Detect should exclude from the BOM.

Go Forge URL: The Go Forge URL to fetch the go.mod descriptor of direct dependencies. If not set, the default Go Forge (https://proxy.golang.org) will be used. This is only applicable to the Go Mod File detector.

default: 30

Go Forge Connection Timeout: The connection timeout in seconds to use when connecting to the Go Forge. If not set, the default connection timeout of 30 seconds will be used.

Gradle Build Command: Gradle command line arguments to add to the gradle/gradlew command line.

default: NONE

Acceptable Values: NONE, UNRESOLVED

Gradle Configuration Types Excluded: Set this value to indicate which Gradle configuration types Detect should exclude from the BOM.

Gradle Executable: The path to the Gradle executable (gradle or gradlew).

Gradle Exclude Configurations: A comma-separated list of Gradle configurations to exclude.

Gradle Exclude Projects: A comma-separated list of Gradle subprojects to exclude.

Gradle Exclude Subproject Paths: A comma-separated list of Gradle subproject paths to exclude.

Gradle Include Configurations: A comma-separated list of Gradle configurations to include.

Gradle Include Projects: A comma-separated list of Gradle subprojects to include.

Gradle Include Project Paths: A comma-separated list of Gradle subproject paths to include.

IaC Scan Target Paths: A comma-separated list of paths to perform IaC scans on.

IaC Scan Arguments: A space-separated list of additional arguments to use when running the IaC Scanner.

default: false

Vulnerability Impact Analysis Enabled: If set to true, Detect will attempt to look for *.class files and generate a Vulnerability Impact Analysis Report for upload to Black Duck SCA.

Lerna Executable: Path of the lerna executable.

default: NONE

Acceptable Values: NONE, PRIVATE

Lerna Package Types Excluded: Set this value to indicate which Lerna package types Detect should exclude from the BOM.

Lerna Packages Excluded: A comma-separated list of Lerna packages to exclude.

Maven Build Command: Maven command line arguments to add to the mvn/mvnw command line.

Maven Executable: The path to the Maven executable (mvn or mvnw).

Dependency Scope Included: A comma separated list of Maven scopes. Output will be limited to dependencies within these scopes (overridden by exclude).

Dependency Scope Excluded: A comma separated list of Maven scopes. Output will be limited to dependencies outside these scopes (overrides include).

default: false

Include Shaded Dependencies: If set to true, Detect will include shaded dependencies as part of BOM.

Maven Modules Excluded: A comma-separated list of Maven modules (subprojects) to exclude.

Additional NPM Command Arguments: A space-separated list of additional arguments that Detect will add at then end of the npm ls command line when Detect executes the NPM CLI Detector on an NPM project.

default: NONE

Acceptable Values: NONE, DEV, PEER, OPTIONAL

Npm Dependency Types Excluded: Set this value to indicate which Npm dependency types Detect should exclude from the BOM.

default: false

Ignore All Workspaces: All workspaces are ignored by the NPM detector for increased performance and precision to scan a massive codebase.

NPM Executable: The path to the Npm executable.

NPM Exclude Workspaces: A comma-separated list of npm workspace relative paths to exclude.

Nuget Config File: The path to the Nuget.Config file to supply to the nuget exe.

default: https://api.nuget.org/v3/index.json

Nuget Packages Repository URL: The source for nuget packages

default: NONE

Acceptable Values: NONE, DEV

Nuget Dependency Types Excluded: Set this value to indicate which Nuget dependency types Detect should exclude from the BOM.

Nuget Artifacts Path: The path to the obj directory build artifacts of the NuGet project, if not the default path.

NuGet Inspector Path: Use this property to point Detect to a local NuGet Inspector executable, instead of the default that Detect downloads from the binary repository.

Nuget Projects Excluded: The projects within the solution to exclude. Detect will exclude all projects with names that include any of the given regex patterns. To match a full project name (for example: 'BaGet.Core'), use a regular expression that matches only the full name ('^BaGet.Core$'). Note that the term 'modules' in the parameter name is synonymous with Nuget 'project'.

default: false

Ignore Nuget Failures: If true errors will be logged and then ignored.

Bash Executable: Path to the Bash executable.

BDIO Output Directory: The path to the output directory for the generated BDIO file.

BDIO File Name: The desired file name of BDIO file Detect produces in the BDIO Output Directory.

default: 0

Detector Search Depth: Depth of subdirectories within the source directory to which Detect will search for files that indicate whether a detector applies.

Git Executable: Path of the git executable

Detect Output Path: The path to the output directory.

Scan Output Path: The output directory for all signature scanner output files. If not set, the signature scanner output files will be in a 'scan' subdirectory of the output directory.

Source Path: The source path is the path to the project directory to inspect. If no value is provided, the source path defaults to the current working directory.

Acceptable Values: NONE, DETECTOR, SIGNATURE_SCAN, BINARY_SCAN, IMPACT_ANALYSIS, DOCKER, BAZEL, IAC_SCAN, CONTAINER_SCAN, COMPONENT_LOCATION_ANALYSIS

Detect Tools Excluded: The tools Detect should not allow, in a comma-separated list. Excluded tools will not be run even if all criteria for the tool is met. Exclusion rules always take precedence.

DEPRECATED VALUES: DOCKER: Docker Inspector support is deprecated. The DOCKER tool value will be removed in a future release.

Acceptable Values: ALL, DETECTOR, SIGNATURE_SCAN, BINARY_SCAN, IMPACT_ANALYSIS, DOCKER, BAZEL, IAC_SCAN, CONTAINER_SCAN, COMPONENT_LOCATION_ANALYSIS

Detect Tools Included: The tools Detect should allow in a comma-separated list. Tools in this list (as long as they are not in the excluded list) will run if all criteria of the tool are met. Exclusion rules always take precedence.

DEPRECATED VALUES: DOCKER: Docker Inspector support is deprecated. The DOCKER tool value will be removed in a future release.

Status JSON Output Path: The directory to place a copy of the status.json file.

SCAAAS Scan Target: Internal use only. Specified file will be uploaded to the BDBA worker for scan analysis in an SCA as a service environment.

default: false

Detector Search Continue: By default, nesting rules limit which detectors can run on a subdirectory based on which detectors applied on any parent directory. Setting this property to true disables nesting rules.

Detect Excluded Directories: A comma-separated list of names, name patterns, relative paths, or path patterns of directories that Detect should exclude. Caution should be exercised when including this parameter on Windows, as the command length generated may exceed OS limitations.

default: false

Detect Excluded Directories Defaults Disabled: If false, Detect will exclude the default list of directory names when searching for applicable detectors.

Detect Tools Output Path: The path to the tools directory where detect should download and/or access things like the Signature Scanner that it shares over multiple runs.

Project Name and Version Detector: The detector that will be used to determine the project name and version when multiple detector types apply. This property should be used with detect.project.tool.

default: DOCKER,DETECTOR,BAZEL

Acceptable Values: DETECTOR, SIGNATURE_SCAN, BINARY_SCAN, IMPACT_ANALYSIS, DOCKER, BAZEL, IAC_SCAN, CONTAINER_SCAN, COMPONENT_LOCATION_ANALYSIS

Detector Tool Priority: The tool priority for project name and version. The project name and version will be determined by the first tool in this list that provides them.

DEPRECATED VALUES: DOCKER: Docker Inspector support is deprecated. The DOCKER tool value will be removed in a future release.

default: NONE

Acceptable Values: NONE, OPTIONAL

Pear Dependency Types Excluded: Set this value to indicate which Pear dependency types Detect should exclude from the BOM.

default: NONE

Acceptable Values: NONE, DEV

Pipfile Dependency Types Excluded: A comma-separated list of dependency types that will be excluded.

PIP Project Name: The name of your PIP project, to be used if your project's name cannot be correctly inferred from its setup.py file.

PIP Project Version Name: The version of your PIP project, to be used if your project's version name cannot be correctly inferred from its setup.py file.

PIP Requirements Path: A comma-separated list of paths to requirements files, to be used to analyze requirements files with a filename other than requirements.txt or to specify which requirements files should be analyzed.

default: false

PIP Include Only Project Tree: By default, pipenv includes all dependencies found in the graph. Set to true to only include dependencies found underneath the dependency that matches the provided pip project and version name.

Pip Executable: The path to the Pip executable.

default: NONE

Acceptable Values: NONE, DEV, OPTIONAL

pnpm Dependency Types: Set this value to indicate which pnpm dependency types Detect should exclude from the BOM.

pnpm Exclude Directories: A comma-separated list of pnpm directories to exclude.

default: NONE

Acceptable Values: ALL, NONE, BLOCKER, CRITICAL, MAJOR, MINOR, OK, TRIVIAL, UNSPECIFIED

Fail on Policy Violation Severities: A comma-separated list of policy violation severities that will fail Detect. If this is set to NONE, Detect will not fail due to policy violations. A value of ALL is equivalent to all of the other possible values except NONE.

Fail on Policy Names with Violations: A comma-separated list of policy names with a non-zero number of violations that will fail Detect.

default: BLOCKER,CRITICAL

Acceptable Values: ALL, NONE, BLOCKER, CRITICAL, MAJOR, MINOR, OK, TRIVIAL, UNSPECIFIED

Fail on Stateless Policy Violation Severities: A comma-separated list of policy violation severities that will fail Detect. If this is set to NONE, Detect will not fail due to policy violations. A value of ALL is equivalent to all of the other possible values except NONE. This property works for both stateless and rapid scans.

Project Description: If project description is specified, your project will be created with this description. For updates, see detect.project.version.update.

default: true

Create Project Version When No Components Found: If set to false, Detect will not create a project version on Black Duck when no components are found and no other scan tools are active.

Project Name: An override for the name to use for the Black Duck SCA project. If not supplied, Detect will attempt to use the tools to figure out a reasonable project name. If that fails, the final part of the directory path where the inspection is taking place will be used.

Project Tier: If a Black Duck SCA project tier is specified, your project will be created with this tier. For updates, see detect.project.version.update.

Version Name: An override for the version to use for the Black Duck SCA project. If not supplied, Detect will attempt to use the tools to figure out a reasonable version name. If that fails, the current date will be used.

Version Nickname: If a project version nickname is specified, your project version will be created with this nickname. For updates, see detect.project.version.update.

Version Notes: If project version notes are specified, your project version will be created with these notes. For updates, see detect.project.version.update.

default: DEVELOPMENT

Acceptable Values: ARCHIVED, DEPRECATED, DEVELOPMENT, PLANNING, PRERELEASE, RELEASED

Version Phase: If project version phase is specified, your project version will be created with this phase. For updates, see detect.project.version.update.

DEPRECATED VALUES: ARCHIVED: With the Black Duck SCA 2026.1.0 release, the ARCHIVED option was deprecated and is no longer supported. To ensure compatibility with both current and upcoming releases, please update your configuration to use a supported project version phase. ARCHIVED: This phase has been deprecated.

default: false

Update Project Version: If set to true, Detect will update the Black Duck SCA project and project version according to configured project and project version properties. (By default, these properties are only set on created projects / project versions.)

Project Version License: If project version license is specified, your project version will be created with this license. For updates, see detect.project.version.update.

default: false

Deep License Analysis: If set to true, enables Deep License Analysis for the project, including detailed license data and snippet analysis.

Clone Project Version Name: The name of the project version to clone this project version from. Respects the given Clone Categories in detect.project.clone.categories or as set on the Black Duck SCA.

default: false

Clone Latest Project Version: If set to true, detect will attempt to use the latest project version as the clone for this project. The project must exist and have at least one version.

Scan Name: An override for the base name Detect will use for the scan (codelocation) it creates. Detect appends a suffix to the base name that indicates the source ("scan" for the signature scanner, "gradle/bom" for the Gradle detector, etc.). If this property is set and multiple code locations are generated from the same source, Detect will also append an index to avoid name collisions. When this property is set, detect.project.codelocation.prefix and detect.project.codelocation.suffix are ignored.

Application ID: Sets the 'Application ID' project setting.

Project Group Name: Sets the 'Project Group' to assign the project to. Must match exactly to an existing project group on Black Duck SCA.

Custom Fields: A list of custom fields with a label and comma-separated value starting from index 0. For each index, provide one label and one value. For example, to set a custom field with label 'example' to 'one,two': detect.custom.fields.project[0].label='example' and detect.custom.fields.project[0].value='one,two'. To set another field, use index 1. Note that these will not show up in the detect configuration log.

Custom Fields: A list of custom fields with a label and comma-separated value starting from index 0. For each index, provide one label and one value. For example , to set a custom field with label 'example' to 'one,two': detect.custom.fields.version[0].label='example' and detect.custom.fields.version[0].value='one,two'. To set another field, use index 1. Note that these will not show up in the detect configuration log.

default: ALL

Acceptable Values: ALL, NONE, COMPONENT_DATA, CUSTOM_FIELD_DATA, DEEP_LICENSE, LICENSE_TERM_FULFILLMENT, VERSION_SETTINGS, VULN_DATA

Clone Project Categories: The value of this property is used to set the 'Cloning' settings on created Black Duck SCA projects. If property detect.project.version.update is set to true, the value of this property is used to set the 'Cloning' settings on updated Black Duck SCA projects.

Scan Name Prefix: A prefix to the name of the scans created by Detect. Useful for running against the same projects on multiple machines.

Scan Name Suffix: A suffix to the name of the scans created by Detect.

Project User Groups: A comma-separated list of names of user groups to add to the project.

Project Tags: A comma-separated list of tags to add to the project. This property is not supported when using Detect in offline mode.

default: true

Allow Project Level Adjustments: If set, created projects will be created with the value of this property. For updates, see detect.project.version.update.

Parent Project Name: When a parent project and version name are specified, the created detect project will be added as a component to the specified parent project version. The specified parent project and parent project version must exist on Black Duck SCA.

Parent Project Version Name: When a parent project and version name are specified, the created detect project will be added as a component to the specified parent project version. The specified parent project and parent project version must exist on Black Duck SCA.

default: EXTERNAL

Acceptable Values: EXTERNAL, INTERNAL, OPENSOURCE, SAAS

Version Distribution: If project version distribution is specified, your project version will be created with this distribution. For updates, see detect.project.version.update.

Project Inspector Path: Use this property to point Detect to a local Project Inspector zip file, instead of the default Project Inspector zip file that Detect downloads from the binary repository. You need to ensure the version is compatible (the same major version that Detect downloads by default).

Project Inspector Global Arguments: A space-separated list of global options to pass to all invocations of the project inspector.

Proxy Host: Hostname of the proxy server.

Bypass Proxy Hosts: A comma separated list of regular expression host patterns that should not use the proxy.

NTLM Proxy Domain: NTLM Proxy domain.

NTLM Proxy Workstation: NTLM Proxy workstation.

Proxy Password: Proxy password.

Proxy Port: Proxy port number.

default: false

Quack Patch Enabled: If set to true, Detect will invoke Quack Patch -- a tool that uses LLMs to generate code patches for vulnerable transitive components.

Quack Patch Output Directory: Specifies the output directory for Quack Patch results.

LLM Gateway API key: Provides the API key used to authenticate with the configured LLM Gateway.

LLM API URL: Specifies the base URL of the LLM Gateway that the Quack Patch tool will send requests to.

default: false

Generate Notices Report: When set to true, a Black Duck SCA notices report in text form will be created in your source directory.

Notices Report Path: The output directory for notices report. Default is the source directory.

default: false

Generate Risk Report (PDF): When set to true, a Black Duck SCA risk report in PDF form will be created.

default: false

Generate Risk Report (JSON): When set to true, a Black Duck SCA risk report in JSON form will be created.

Risk Report (PDF) Output Path: The output directory for risk report in PDF. Default is the source directory.

Rush Projects Excluded: A comma-separated list of rush pnpm subspaces to exclude.

Sbt Executable: Path to the Sbt executable.

Signature Scanner Arguments: A space-separated list of additional arguments to use when running the Black Duck SCA signature scanner. Key-value pairs specified as arguments will replace the same entries specifed elswhere. Available signature scanner properties can be determined by specifying '--help' when executing the signature scanner jar file from the command line.

default: false

Signature Scanner Copyright Search: When set to true, user will be able to scan and discover copyright names in Black Duck SCA. Corresponding Signature Scanner CLI Argument: --copyright-search.

default: false

Signature Scanner CSV Archive Output: When set to true Signature Scanner output will be in CSV format. Corresponding Signature Scanner CLI Argument: --outputFormat csv for offline mode, --upload-csv for online mode.

default: false

Signature Scanner Dry Run: If set to true, the signature scanner results are not uploaded to Black Duck SCA, and the scanner results are written to disk via the Signature Scanner CLI argument: --dryRunWriteDir.

default: NONE

Acceptable Values: NONE, SOURCE, BINARY, ALL

Individual File Matching: Users may set this property to indicate what types of files they want to match. Corresponding Signature Scanner CLI Argument: --individualFileMatching.

default: false

Signature Scanner License Search: When set to true, user will be able to scan and discover license names in Black Duck SCA. Corresponding Signature Scanner CLI Argument: --license-search.

Signature Scanner Local Path: To use a local signature scanner, specify the path where the signature scanner was unzipped. This will likely look similar to 'scan.cli-x.y.z' and includes the 'bin, icon, jre, and lib' directories of the expanded scan.cli.

Signature Scanner Target Paths: If this property is not set, the signature scanner target path is the source path (see property detect.source.path). If this property is set, the paths provided in this property's value will be signature scanned instead (the signature scanner will be executed once for each provided path).

default: NONE

Acceptable Values: NONE, SNIPPET_MATCHING, SNIPPET_MATCHING_ONLY

Snippet Matching: Use this value to enable the various snippet scanning modes. For a full explanation, refer to Running a component scan using the Signature Scanner command line. Corresponding Signature Scanner CLI Arguments: --snippet-matching, --snippet-matching-only.

default: DEFAULT

Acceptable Values: DEFAULT, RETAIN_UNMATCHED, DISCARD_UNMATCHED

Reduced Persistence: Use this value to control how unmatched files from signature scans are stored. For a full explanation, refer to about reduced persistence signature scanning.

default: false

Upload source mode: If set to true, the signature scanner will, if supported by your Black Duck SCA version, upload source code to Black Duck SCA. Corresponding Signature Scanner CLI Argument: --upload-source.

default: 4

Detect Excluded Directories Search Depth: Enables you to adjust the depth to which Detect will search when creating signature scanner exclusion patterns.

uv Executable: The path to the uv executable.

Exclude UV Dependency Groups: Set this value to indicate which UV dependency groups Detect should exclude from the BOM.

Include Only the Specified UV Dependency Groups: A comma-separated list of dependency group names to exclusively include in the BOM.

uv Exclude Workspace Members: A comma-separated list of uv workspace members to exclude.

default: false

Ignore All Workspaces: All workspaces are ignored by the Yarn detector for increased performance and precision to scan a massive codebase.

default: NONE

Acceptable Values: NONE, NON_PRODUCTION

Yarn Dependency Types Excluded: Set this value to indicate which Yarn dependency types Detect should exclude from the BOM.

Yarn Exclude Workspaces: A comma-separated list of Yarn workspaces (specified by the workspace directory's relative path) to exclude.