問題文
An organization already licenses a third-party static analysis product and wants its results inside the same triage workflow. What is the purpose of ingesting those findings rather than reading them in the vendor's own console?
選択肢
- Ingested findings are exempt from policy evaluation.
- Ingestion replaces the third-party product's own scanning engine with the native engine, so the external license can be dropped immediately after the integration has been verified for one repository.
- Once normalized, the external findings are governed by the same policies and prioritization as native results and appear in the same issue tables.
- Ingestion is the only way to obtain license compliance and package operational risk findings for open-source dependencies, since the native scanners report versions and nothing about the project behind them.