Sbom Core

SBOM cleanup removes older software bill of materials records that match conditions you define and can help you reduce your data volume in the SBOM Workspace.

Several types of components are installed with activation of the Software Bill of Materials applications, including tables, user roles, and scheduled jobs.

View a list of the open source and third-party software components that you’re using in your application development. Get insights into software licenses, version information, and the known vulnerabilities in your components in the Software Bill of Materials (SBOM) files that you upload into your instance.

Resolve (assign) classified licenses to specific components with the Component License Resolution feature. Assign licenses to components with missing information or incorrect license information or create new licenses so your overall license compliance can be calculated.

Check the upload status for the Software Bill of Materials (SBOM) files that you upload in the BOM Queue module in the Software Bill of Materials (SBOM) Workspace. Track the files that you upload successfully, your upload history, and errors.

Determine whether any vulnerabilities are associated with the components in an uploaded Software Bill of Materials (SBOM) file.

Classify the component licenses you upload with your SBOM files with the License Classification feature.

The Components module in the Software Bill of Materials (SBOM) Workspace displays current information about vulnerable, stale, abandoned, and high-risk combinations for the components you import.

You can edit some of the parameters for the Deps.dev and OSV.dev integrations. There are also two code trigger versions of these integrations that are used strictly for internal workflows, and you should not initiate these integrations on-demand. Additionally, you can activate a scheduled job to create policies using Policy as Code Engine (PaCE).

Before you can see application vulnerable items (AVITs) in the Software Bill of Materials (SBOM) Workspace, you must set up the conditions under which AVITs are created.

Download and activate the required applications for the Software Bill of Materials (SBOM) application prior to uploading SBOM files.

Set up the conditions under which application vulnerable items (AVITs) are created automatically in the AVI Creation Rules module in the Software Bill of Materials (SBOM) Workspace.

Identify the components used in your organization's applications from Software Bill of Materials (SBOM) files you upload into your instance. Understand any risks associated with using open-source software to help you determine your potential exposure, view license compliance, and fix vulnerabilities.

Uploaded data is rolled up to the visualizations on the landing (Home) page in the Software Bill of Materials (SBOM) Workspace. Data is modified after you upload files so vulnerability analysts can see trends and review current information about your components.

Upload Software Bill of Materials (SBOM) files manually.

Download and activate the required applications for the Software Bill of Materials (SBOM) application prior to uploading files.

Classify licenses and resolve (match) them to components, or create licenses in the License administration module in the SBOM workspace. Classifying and matching licenses to your components permits you determine your license compliance for the proprietary, open-source, and vendor-supplied software components you upload in your SBOM files.

Review the following information prior to uploading Software Bill of Materials files using an API.

Create and run a one-time cleanup rule to permanently purge older SBOM records that match the conditions you specify.

Third-party vulnerability intelligence and other integrations with the Software Bill of Materials applications can enhance the data of your uploaded files.

Generate and upload Software Bill of Materials SBOM files for software throughout its continuous integration and continuous deployment development cycles.

The SBOM applications enable you to upload files and view details for entities, component inventories, license information and other details in the Software Bill of Materials Workspace.

Vulnerability analysts view uploaded software bill of materials files in records, data visualizations, as well as enhanced vulnerability intelligence in the Software Bill of Materials (SBOM) Workspace.