> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-code/ox-code-inventory/sbom.md).
# SBOM
The Software Bill of Materials (SBOM) provides a unified inventory of open-source and third-party libraries across your applications. It helps security and engineering teams understand what dependencies are in use, where they are used, and the risk and license posture for each version.
SBOM collects data from connected sources, including source control, CI/CD pipelines, container images, and imported files. It automatically discovers packages, resolves versions, and categorizes them by application and source. This automated discovery improves visibility into supply-chain risk, as follows:
* **Dependency discovery:** SBOM identifies and catalogs libraries by ecosystem (npm, PyPI, Maven, Go, and others), version, and application.
* **Vulnerability visibility:** Shows known CVEs for each library and version so you can prioritize remediation.
* **License compliance:** Surfaces detected licenses and highlights items that may violate your organization’s policy.
* **Usage context:** Indicates whether a library is actually used in code or artifacts, helping you focus on what matters.
* **Health signals:** Provides indicators such as maintenance activity, update availability, popularity, and release dates to guide upgrade decisions.
* [**Drill-down details:**](/ox-code/ox-code-inventory/sbom/sbom-library-details.md) For each library, SBOM displays metadata, policy results, related artifacts, and maintainers so you can assess risk and plan next steps.
## SBOM table columns
| Column | Explanation |
| ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Library | Package name with version in the format `name@version`. Select to open the details drawer. |
| License | Detected license for the selected version, for example Apache-2.0, MIT, BSD-3-Clause, or N/A if unknown. |
| CVE | Vulnerability status for the selected version. A check mark means no known CVEs. A number shows the CVE count. |
| Benign | Libraries your organization flags as benign. A check mark means benign. |
| Used | Whether the library is used in code or artifacts. A check mark means OX finds usage. |
| Updated | Whether a newer version exists. A check mark means you are on the latest version. |
| Maintained | Upstream project activity signal. A check mark means the project is maintained. |
| Popular | Community popularity signal. Higher values indicate broader adoption. |
| [Runtime Status](/ox-cloud/ox-runtime-sensor.md) (EA capability) |
Shows whether a third-party library is actually loaded in memory during runtime. This helps identify which dependencies are active in the running application and which ones exist in the SBOM but are not used.
Loaded The library is loaded in memory during runtime and affects the running application.
Not Loaded The library appears in the SBOM but is not loaded in memory during runtime and may not influence application behavior.
Runtime Status is an Early Access capability and is visible only when the OX Runtime Sensor is connected.
|
| Source | Where OX detected the library, for example repository or registry. Icons link to the source when available. |
| App name | The application that includes the library. Select to open the app in OX. |
| | |
## SBOM filters
| Filter | Description |
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Application** | Displays libraries associated with selected applications. |
| **App Tag** | Displays libraries from applications assigned specific tags. Use tags to filter libraries across groups of applications that share the same classification. |
| **Library** | Displays specific libraries and versions identified in the SBOM. |
| **Library Name** | Displays all detected versions of selected libraries. |
| **Library Version** | Displays libraries that match selected version values. |
| **Dependency** | Displays libraries based on their dependency relationship, such as direct or indirect dependencies. |
| **Package Manager** | Displays libraries managed by selected package ecosystems or package managers, such as npm, Maven, or PyPI. |
| **Languages** | Displays libraries associated with selected programming languages. |
| **Issues** | Displays libraries based on whether they have associated security issues. |
| **CVE** | Displays libraries affected by selected CVEs. |
| **Vulnerability Severity** | Displays libraries with vulnerabilities that match selected severity levels. |
| **License** | Displays libraries that use selected open-source licenses. |
| **Copyright** | Displays libraries based on their detected copyright information. |
| **Package Name** | Displays libraries associated with selected package names. |
| **Visibility** | Displays libraries based on the visibility of their associated source, such as public or private. |
| **Artifact Source** | Displays libraries associated with artifacts from selected sources. |
| **Artifact Image** | Displays libraries found in selected container images. |
| **Artifact Image Tag** | Displays libraries found in container images with selected image tags. |
| **Registry Type** | Displays libraries found in artifacts from selected container registry types. |
| **Artifact OS Image** | Displays libraries associated with selected container operating system images. |
| **Artifact Base Image** | Displays libraries associated with selected container base images. |
| **Source** | Displays libraries based on where OX identified them, such as a repository or registry. |
| **Code-to-Cloud Exposure** | Displays libraries based on whether they are associated with workloads or assets exposed from code to cloud. |
| **Runtime Status** | Displays libraries based on their observed runtime status, helping distinguish components with runtime activity from those without it. |
| **First Seen** | Displays libraries according to when OX first identified them, helping isolate newly discovered components. |
## Importing an SBOM
You can import an SBOM in CycloneDX format to analyze third-party and open-source components that are not part of repositories scanned by OX. This allows you to identify vulnerabilities and review component information without providing the source repository.
**To import an SBOM:**
1. Open the **SBOM** page.
2. Select **Import SBOM**.
3. Add the CycloneDX SBOM file that you want to import.
4. Select **Import**.
OX processes the components in the imported SBOM as part of its analysis and displays the identified components and vulnerabilities in OX.
#### Identifying imported SBOM data
Components from an imported SBOM are associated with an **Imported SBOM** application rather than an application discovered from a scanned repository.
For imported SBOM components:
* The application is identified by the SBOM icon.
* The **Origin** field indicates that the component was imported from a vendor SBOM file.
* You can review the detected vulnerabilities and available context in OX.
To view or manage previously imported SBOM files, select **Manage Files** from the SBOM page.
## Related topics:
[SBOM Details](/ox-code/ox-code-inventory/sbom/sbom-library-details.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.ox.security/ox-code/ox-code-inventory/sbom.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
