SBOM

The Software Bill of Materials (SBOM) provides a unified inventory of open-source and third-party libraries across your applications. It helps security and engineering teams understand what dependencies are in use, where they are used, and the risk and license posture for each version.

SBOM collects data from connected sources, including source control, CI/CD pipelines, container images, and imported files. It automatically discovers packages, resolves versions, and categorizes them by application and source. This automated discovery improves visibility into supply-chain risk, as follows:

• Dependency discovery: SBOM identifies and catalogs libraries by ecosystem (npm, PyPI, Maven, Go, and others), version, and application.

• Vulnerability visibility: Shows known CVEs for each library and version so you can prioritize remediation.

• License compliance: Surfaces detected licenses and highlights items that may violate your organization’s policy.

• Usage context: Indicates whether a library is actually used in code or artifacts, helping you focus on what matters.

• Health signals: Provides indicators such as maintenance activity, update availability, popularity, and release dates to guide upgrade decisions.

• Drill-down details: For each library, SBOM displays metadata, policy results, related artifacts, and maintainers so you can assess risk and plan next steps.

SBOM table columns

Column	Explanation
Library	Package name with version in the format name@version. Select to open the details drawer.
License	Detected license for the selected version, for example Apache-2.0, MIT, BSD-3-Clause, or N/A if unknown.
CVE	Vulnerability status for the selected version. A check mark means no known CVEs. A number shows the CVE count.
Benign	Libraries your organization flags as benign. A check mark means benign.
Used	Whether the library is used in code or artifacts. A check mark means OX finds usage.
Updated	Whether a newer version exists. A check mark means you are on the latest version.
Maintained	Upstream project activity signal. A check mark means the project is maintained.
Popular	Community popularity signal. Higher values indicate broader adoption.
Runtime Status (EA capability)	Shows whether a third-party library is actually loaded in memory during runtime. This helps identify which dependencies are active in the running application and which ones exist in the SBOM but are not used. Loaded The library is loaded in memory during runtime and affects the running application. Not Loaded The library appears in the SBOM but is not loaded in memory during runtime and may not influence application behavior. Runtime Status is an Early Access capability and is visible only when the OX Runtime Sensor is connected.
Source	Where OX detected the library, for example repository or registry. Icons link to the source when available.
App name	The application that includes the library. Select to open the app in OX.

SBOM filters

Filter	Description
Application	Displays libraries associated with selected applications.
App Tag	Displays libraries from applications assigned specific tags. Use tags to filter libraries across groups of applications that share the same classification.
Library	Displays specific libraries and versions identified in the SBOM.
Library Name	Displays all detected versions of selected libraries.
Library Version	Displays libraries that match selected version values.
Dependency	Displays libraries based on their dependency relationship, such as direct or indirect dependencies.
Package Manager	Displays libraries managed by selected package ecosystems or package managers, such as npm, Maven, or PyPI.
Languages	Displays libraries associated with selected programming languages.
Issues	Displays libraries based on whether they have associated security issues.
CVE	Displays libraries affected by selected CVEs.
Vulnerability Severity	Displays libraries with vulnerabilities that match selected severity levels.
License	Displays libraries that use selected open-source licenses.
Copyright	Displays libraries based on their detected copyright information.
Package Name	Displays libraries associated with selected package names.
Visibility	Displays libraries based on the visibility of their associated source, such as public or private.
Artifact Source	Displays libraries associated with artifacts from selected sources.
Artifact Image	Displays libraries found in selected container images.
Artifact Image Tag	Displays libraries found in container images with selected image tags.
Registry Type	Displays libraries found in artifacts from selected container registry types.
Artifact OS Image	Displays libraries associated with selected container operating system images.
Artifact Base Image	Displays libraries associated with selected container base images.
Source	Displays libraries based on where OX identified them, such as a repository or registry.
Code-to-Cloud Exposure	Displays libraries based on whether they are associated with workloads or assets exposed from code to cloud.
Runtime Status	Displays libraries based on their observed runtime status, helping distinguish components with runtime activity from those without it.
First Seen	Displays libraries according to when OX first identified them, helping isolate newly discovered components.

Importing an SBOM

You can import an SBOM in CycloneDX format to analyze third-party and open-source components that are not part of repositories scanned by OX. This allows you to identify vulnerabilities and review component information without providing the source repository.

To import an SBOM:

1. Open the SBOM page.

2. Select Import SBOM.

1. Add the CycloneDX SBOM file that you want to import.

2. Select Import.

OX processes the components in the imported SBOM as part of its analysis and displays the identified components and vulnerabilities in OX.

Identifying imported SBOM data

Components from an imported SBOM are associated with an Imported SBOM application rather than an application discovered from a scanned repository.

For imported SBOM components:

• The application is identified by the SBOM icon.

• The Origin field indicates that the component was imported from a vendor SBOM file.

• You can review the detected vulnerabilities and available context in OX.

To view or manage previously imported SBOM files, select Manage Files from the SBOM page.

Related topics:

SBOM Details