What is an SBOM, and what can it tell me?

An SBOM is a machine-readable inventory of software components. It can record components, versions, identifiers and dependency relationships so tools can work with that inventory.

What is in an SBOM?

CycloneDX can represent first-party and third-party components, their versions and their dependency relationships. Component identifiers help distinguish one component from another in tooling.

An inventory gives a team a structured record of what has been supplied to the inventory. It is useful to keep component names, versions and identifiers together when a tool needs to compare that record with other information.

What can it tell you?

Tools can use component information to match components to vulnerability information. The usefulness of that matching depends on the component details in the inventory, especially versions and identifiers.

A fictional example

This small synthetic fragment illustrates component fields. It is not a complete SBOM or an upload file.

{
  "components": [
    {
      "type": "library",
      "name": "fictional-parser",
      "version": "1.9.4",
      "purl": "pkg:npm/fictional-parser@1.9.4"
    }
  ]
}

Technical limitations

The quality of an inventory depends on the component information supplied to it.
An inventory describes components; it does not describe observed test results.

Source

Read the CycloneDX SBOM capabilities page: CycloneDX SBOM capabilities

Set up an SBOM

Use the existing guide for a practical setup and upload workflow.