Update Your IQ Server License Threat Groups - Sonatype Labs - Sonatype Community
post by joshua.richards on Sep 2, 2020
Joshua Richards
How can we receive the latest license information from Sonatype?
post by mworthington on Sep 3, 2020
Michael Worthington
@joshua.richards, the latest license categorizations are contained in the various CSV files attached to this topic. Is that what you are looking for?
p.s. I am seeing an issue with the attachment from 7/21. I am looking into that. In the meantime, you can use the 7/15 csv.
post by dgriffin on Sep 11, 2020
Dgriffin
license_ltgs_20200911.csv (42.1 KB)
This file should be accessible and contains the latest license to LTG mappings.
post by dgriffin on Sep 23, 2020
Dgriffin
If you do run into issues with the updater feel free to comment here or reach out to me directly. More than happy to walk people through or debug any issues. Please don’t open a support ticket as this product is in labs and isn’t supported by our support staff.
post by u.maurer on Nov 12, 2020
Uwe Maurer
We just tried updating our License Threat Groups. Unfortunately we encountered the following error:
$ java -jar ltg-updater-1.0.0.jar -s https://example-url.com -u admin -p password -i license_ltgs_04172020.csv -d -f
Add all unassigned licenses to LTGs in root organization? [Y/n]
Exception in thread "main" java.lang.NullPointerException
at zz.ab.c(SourceFile:94)
at com.sonatype.insight.brain.ltg.updater.c.b(SourceFile:173)
at com.sonatype.insight.brain.ltg.updater.c.a(SourceFile:146)
at com.sonatype.insight.brain.ltg.updater.c.a(SourceFile:87)
at com.sonatype.insight.brain.ltg.updater.c.a(SourceFile:68)
at com.sonatype.insight.brain.ltg.updater.Main.main(SourceFile:46)
Does this have to do with using HTTPS? We are using openjdk version 11.0.9.
post by dgriffin on Nov 23, 2020
Dgriffin
Out of curiosity does your ROOT organization have zero LTGs?
post by u.maurer on Dec 30, 2020
Uwe Maurer
Sorry for the late answer: No, it doesn’t. The ROOT organization has the usual LTGs (Banned, Weak Copyleft, … ) All LTGs in ROOT contain at least one license.
However, all organizations below ROOT do not have their own LTGs (they inherit all LTGs from ROOT).
post by dgriffin on Jan 12, 2021
Dgriffin
Latest LTG mappings: ltgs_20210112.csv (42.4 KB)
post by u.maurer on Jan 13, 2021
Uwe Maurer
Sure a meeting (per video …) would be a great idea! It would be best to connect with one of our devops engineers, therefore we need to schedule an appointment 1-2 days in advance. As we are located in Germany we use CET.
post by dgriffin on May 26, 2021
Dgriffin
Latest LTG mappings: license_threat_groups_20210526.csv (47.0 KB)
post by dgriffin on Jul 26, 2021
Dgriffin
Latest LTG mappings:
license_threat_groups_20210726.csv (50.4 KB)
post by cathy.x.l.lv on Oct 26, 2021
xiuli lv
Hello,
May I know how to solve this null pointer exception?
post by dgriffin on Dec 16, 2021
Dgriffin
Hi all, there is an updated version of the LTG updater: ltg-updater-1.0.1.jar (7.6 MB)
Let me know if that resolves your issues, though likely if you are seeing NPE it could be the result of how you’ve configured your Lifecycle instance and I’d need to know more about your configuration to address the issue.
In addition to the latest LTG mappings: ltg_20211216.csv (50.8 KB)
post by dgriffin on Feb 11, 2022
Dgriffin
Hi all, here are the latest LTG mappings:
ltgs_20220210.csv (54.1 KB)
post by shailendra.bhadauria on Aug 2, 2022
Shailendra Bhadauria
@dgriffin Is this the most recent version of licenses? I noticed the list that you have here is about 100 licenses less. I currently have 1931 on our end but the list in “ltgs_20220210.csv” just has 1843? Also, how can we make use of this capability if we have custom defined threat groups?
post by dgriffin on Dec 6, 2022
Dgriffin
Hi all, sorry it’s been a while since I posted a mapping. Here is the latest mappings:
license_threat_groups_12062022.csv (57.0 KB)
post by dgriffin on Jan 9, 2023
Dgriffin
Hi all, new year, new mapping. Here is the latest as of 12/29/2022:
license_threat_groups_12292022.csv (58.1 KB)
post by kristin.chew on Jan 11, 2023
Kristin Chew
Do you have a change log for this file?
post by dgriffin on Mar 20, 2023
Dgriffin
Hi all, updated version of the LTG updater that will work with N-level organizations (IQ 156). It will also continue to work with previous versions as well.
ltg-updater-1.0.2.jar (7.9 MB)
post by dgriffin on Jun 28, 2023
Dgriffin
Hi all,
Latest license mappings can be found here 06/28/2023:
license_threat_groups_06282023.csv (64.0 KB)
post by dhandley on Sep 28, 2023
Dhandley
Hi all,
Latest license mappings can be found here 07/23/2023
license_threat_groups_09272023.csv (66.5 KB)
post by rene.schoenlein on Oct 5, 2023
Rene Schönlein
Quick question, is it by mistake that the CSV now contains a header row. As far as I can tell, all previous updates did not contain a header row.
post by dhandley on Dec 4, 2023
Dhandley
I think I just forgot to remove the header row last time. It was my first time running the update since taking over from Dariush.
post by u.maurer on Dec 5, 2023
Uwe Maurer
I appreciate getting regular updates for license threat groups. However, I am wondering if releasing these updates in a community thread is a proper solution. Of course one can collect all information needed by reading through this thread - but don’t you think there might be a better, more official distribution method of the update and the tool needed to integrate it?
post by dhandley on Feb 28, 2024
Dhandley
Hi all,
Latest license mappings can be found here 02/28/2024
license_threat_groups_02012024.csv (69.5 KB)
post by ingmar.vis on Mar 6, 2024
Ingmar Vis
Thanks, we will compare the list with our own configurations.
post by twinter on Apr 3, 2024
Travis Winter
Hello everyone!
The latest license mappings from 2024/03/29 are attached
license_threat_groups_03292024.csv (71.3 KB)
post by dhandley on Apr 18, 2024
Dhandley
Looks like this is an issue with your iq server, please contact support.
post by jplevac on Apr 19, 2024
Jean-Pierre Levac
@venkat.sannamuri this is a special bash character that you’re passing on the command line. You can try simply escaping it with \.
Try:
java -jar ltg-updater-1.0.2.jar -s https://nexusxxxx/ -u admin -p ‘XXX\!XXXX’ -i license_ltgs_02012024.csv -d -f
post by twinter on May 16, 2024
Travis Winter
Hello everyone!
We have a new release of the License LTG Updater that contains support for the new AI-ML LTG and associated licenses:
ltg-updater-1.0.3.jar (8.4 MB)
Additionally, here are the latest license mappings:
license_threat_groups_04302024.csv (74.1 KB)
post by ovoronin on Jun 18, 2024
Ole Voronin
Hi all. The latest license mappings from 2024-05-28 are here:
license_threat_groups_05282024.csv (76.2 KB)
post by jplevac on Jul 19, 2024
Jean-Pierre Levac
Hi all. The latest license mappings from 2024-06-28 are here:
license_threat_groups_06282024.csv (77.3 KB)
post by djb on Jul 26, 2024
Daniel Brereton
I have to agree with @u.maurer, this seems like the wrong channel for a versioned official .jar. Why not a separate page like how the Reference Policy files are provided? Feels like a similar use case.
post by jplevac on Aug 6, 2024
Jean-Pierre Levac
We realize this process is painful and are looking at ways of automating some of these steps. I’ll forward your message to appropriate internal stakeholders.
post by jplevac on Aug 6, 2024
Jean-Pierre Levac
Hi all. The latest license mappings from 2024-07-30 are here:
license_threat_groups_07302024.csv (78.2 KB)
post by twinter on Sep 17, 2024
Travis Winter
Hello! The latest license mappings from 2024-08-29 are here:
license_threat_groups_08292024.csv (79.3 KB)
post by twinter on Oct 7, 2024
Travis Winter
Hello! The latest license mappings from 2024-09-26 can be found here:
license_threat_groups_09262024.csv (80.5 KB)
post by twinter on Nov 1, 2024
Travis Winter
Hello everyone, the latest license information for Oct, 2024 can be found here:
license_threat_groups_10312024.csv (81.5 KB)
post by tiam-shin.yong on Nov 11, 2024
Tiam Shin Yong
Hello. I agree with the comments here. As an admin of IQ, this update process is challenging due to the number of licenses in the LTG.
While the version updates and the tool are useful, they do not apply to our use case, where we customize our LTG based on IT Law guidance.
Currently, there is no efficient way to compare the list of licenses in the updated LTG with those configured in IQ (other than manually) to identify discrepancies and decide whether to update the policies.
It would be great if you could automate this process or provide a UI feature to identify the differences between the updated list and the customer’s IQ list. If this update tool is intended to automate updates, why not integrate it into the IQ release so that policies are updated automatically when the IQ version is upgraded?
post by twinter on Dec 13, 2024
Travis Winter
Hello everyone, the latest license information for Nov, 2024 can be found here:
license_threat_groups_11282024.csv (83.2 KB)
post by jplevac on Jan 14, 2025
Jean-Pierre Levac
Hello everyone, the latest license information for December, 2024 can be found here:
license_threat_groups_01062025.csv (85.2 KB)
post by jonathan.solan on Feb 7, 2025
Jonathan Solan
Hi,
I have a quick question.
Are these group updates not included with the IQ Server releases? Do the group updates have to be performed manually?
post by jzora on Feb 7, 2025
Jonathan Zora
That’s correct, Jonathan. New license data is added to the platform all the time, but threat groups need to be updated manually. We do this so as not to overwrite any modifications your organization’s legal teams may have made.
For more details, check our documentation on the topic.
post by jonathan.solan on Feb 11, 2025
Jonathan Solan
Thanks Jonathan.
Is it possible to make the current LTG listing available via CLI? Or another option?
post by djb on Feb 13, 2025
Daniel Brereton
You can GET this undocumented endpoint for a list of LTGs: https://{{iq_url}}/rest/licenseThreatGroup/organization/{{organization_id}}.
But, add /applicable on the end of the above to return the individual licenses within each of those returned LTGs.
{
"licenseThreatGroupsByOwner": [
{
"ownerId": "example_org_id",
"ownerName": "Example Org",
"ownerType": "organization",
"licenseThreatGroups": [
{
"id": "xb3q7cvt27d5323aa677899398a4c74d",
"name": "Banned",
"threatLevel": 10,
"licenses": [
{
"id": "h9d3c52fgtyu4b956p3f5935y309u973",
"ownerId": "example_org_id",
"licenseThreatGroupId": "vd3f7fbd27d5423aa698765098a4c67d",
"licenseId": "GPL-3.0"
}
]
}
]
}
]
}
post by jplevac on Feb 18, 2025
Jean-Pierre Levac
Hello everyone, the latest license information for January, 2025 can be found here:
license_threat_groups-01312025.csv (86.2 KB)
post by jplevac on Mar 17, 2025
Jean-Pierre Levac
Hello everyone, the latest license information for February, 2025 can be found here:
license_threat_groups_02282025.csv (87.1 KB)
post by nsai on Apr 4, 2025
Nsai
Hello everyone, the latest license information for March, 2025 can be found here:
license_threat_groups_04042025.csv (88.5 KB)
post by nsai on Apr 28, 2025
Nsai
Hello everyone, the latest license information for April, 2025 can be found here:
license_threat_groups_04282025.csv (89.6 KB)
post by nsai on May 27, 2025
Nsai
Hello everyone, the latest license information for May, 2025 can be found here:
license_threat_groups_05272025.csv (90.7 KB)
post by nsai on Jun 26, 2025
Nsai
Hello everyone, the latest license information for June, 2025 can be found here:
license_threat_groups_06262025.csv (92.0 KB)
post by nsai on Aug 1, 2025
Nsai
Hello everyone, the latest license information for July, 2025 can be found here:
license_threat_groups_07312025.csv (93.0 KB)
post by nsai on Aug 28, 2025
Nsai
Hello everyone, the latest license information for August, 2025 can be found here:
license_threat_groups_08282025.csv (94.3 KB)
post by nsai on Sep 29, 2025
Nsai
Hello everyone, the latest license information for September, 2025 can be found here:
license_threat_groups_09292025.csv (95.6 KB)
Hello everyone, the latest license information for October, 2025 can be found here:
license_threat_groups_11012025.csv (97.6 KB)
post by nsai on Dec 1, 2025
Nsai
Hello everyone, the latest license information for November, 2025 can be found here:
license_threat_groups_11302025.csv (99.9 KB)
post by nsai on Dec 3, 2025
Nsai
Hello everyone, the latest license information after a priority release for December, 2025 can be found here:
license_threat_groups_12032025.csv (100.3 KB)
Updated version of file:
license_threat_groups_12042025.csv (100.3 KB)
post by nsai on Dec 31, 2025
Nsai
Hello everyone, the latest license information for December, 2025 month end can be found here:
license_threat_groups_12312025.csv (101.3 KB)