Exporting Software Bill of Materials on CycloneDX
Last updated
Was this helpful?
A Software Bill of Materials (SBOM) is a detailed inventory of all software components, dependencies, and associated metadata within an application. The purpose of an SBOM is to provide clear visibility into these components, ensuring they meet security and compliance standards.
SBOMs can deliver the transparency that software users now demand by enabling a standard approach to understanding what is in an application and why.
Prisma Cloud supports exporting SBOM files in the CycloneDX v1.4 standard (JSON or XML) for function, image, and host scans.
The SBOM files contain the following attributes.
Name
Name of the package
BOM-REF
Package URL (purl) if it exists; otherwise, UUID (for applications)
Package version
Version number of the package
Package author
Only for specific package types: rpm, jem, apk, and deb
PURL identifier
Package URL that identifies the package
License
Package license details
Metadata:
Timestamp
Time of printing
Type
Asset type.
Images (in all stages) are categorized as containers. Serverless functions (in all stages) are categorized as services. Hosts and VMs are categorized as frameworks.
Name
Asset ID for images, hosts, and functions.
SBOM files can be downloaded either through API calls or twistcli.
The following option in twistcli tool enables you to download SBOMs for function, image, and host scans:
--SBOM [file_format]
The file format values are cyclonedx_json or cyclonedx_xml.
The SBOM output is concatenated with the scan results output. Use the --output flag to print the scan results and SBOM output to a specified file.
The following API endpoints enable you to download SBOMs for function, image, and host scans:
Last updated
Was this helpful?
Was this helpful?