Introduction
Understanding organizationsUnderstanding componentsManage organizationsManage componentsManage component Jira integrations
Set up your first organizationUnderstanding users and teamsUnderstanding role-based access controlManage usersManage teamsConfigure role-based access controlRBAC permissions reference
Understanding authentication in CloudBees UnifySet up multifactor authenticationConfigure SAML single sign-onConfigure OIDC authenticationConfigure network security policiesNetwork security reference
Understanding platform configurationUnderstanding environmentsManage properties and secretsManage environmentsTrack environment inventoryConfigure containersSet up preconfigured actionsConfigure notifications
Accessibility policy referenceShared responsibility model referenceSubscription and services agreementSupport policiesSupported browsers and external tools
Introduction
Understanding feature managementUnderstanding Configuration as CodeGet started with feature managementCreate and manage feature flagsConfigure feature flag targetingOrganize feature flagsImplement feature flag governanceConfiguration as Code reference
Understanding flag impressions and activity statusUnderstanding flag healthUnderstanding code referencesReview and clean up feature flagsSet up code references
Understanding Jira integration for feature flagsSet up the Jira integrationLink Jira tickets to feature flags
Understanding multiple SDK keysBuild your first mobile app with feature flagsBuild your first feature-flagged web applicationBuild your first feature-flagged backend serviceInstall client-side SDKsInstall server-side SDKsConfigure multiple SDK keysMobile SDK referenceWeb SDK referenceBackend SDK referenceClient SDK referenceFlag implementation reference
Introduction
Understanding CI workflowsCreate a build workflowCreate and manage workflowsCreate reusable workflowsTest and validate containers in workflowsCheck out source codeTrigger workflows remotelyWorkflow syntax referenceJobs syntax referenceSteps syntax referenceServices syntax reference
Monitor workflow runsView test results in runsView evidence in runsView deployments in runsManage workflow artifactsPublish test resultsPublish evidence itemsGenerate a software bill of materialsManage ServiceNow change requests
Configure workflow credentialsConfigure AWS credentialsConfigure container registry credentialsConfigure Git credentialsIntegrate external secret providers
Understanding GitHub Actions integrationSet up GitHub Actions integrationDisplay GitHub Actions workflows and runsRegister GHA build artifactsPublish GHA deployed artifactsPublish GHA test resultsPublish GHA evidence itemsTrigger CloudBees workflows from GitHub ActionsScan with GitHub Actions
Understanding CloudBees CI and Jenkins® integrationConnect CI and Jenkins controllersMonitor CI and Jenkins buildsRegister CI build artifactsRegister CI deployed artifactsPublish CI test resultsConfigure CI security scanningCI and Jenkins integration reference
Build and publish container imagesUnderstanding external CI/CD integrationsRun external CI/CD jobsExternal CI/CD action reference
Introduction
Understanding release orchestrationManage applicationsCreate deployer workflowsCreate staged workflowsCreate and manage releasesOrchestrate multi-workflow releasesRelease management reference
Understanding artifact managementRegister and track artifactsStore and retrieve artifactsPromote artifactsGenerate a software bill of materialsArtifact management reference
Deploy with HelmDeploy to KubernetesContainer deployment reference
Deploy to AWSAWS deployment reference
Deploy with enterprise platformsExecute remote deployment commandsEnterprise deployment reference
Verify deployments with New RelicDeployment verification reference

Configure SBOM analysis

3 minute read

Configure Software Bill of Materials (SBOM) analysis to maintain real-time visibility into direct and transitive dependencies for binary artifacts, supporting software supply chain risk management and compliance requirements.

SBOM analysis automatically generates comprehensive dependency inventories during binary security scanning, making it easier to identify problematic software components and track open-source and commercial software usage across your application portfolio.

For conceptual information about SBOM analysis in application security, refer to Understanding application security posture management.

You need organization Admin permissions to enable security tools and implicit security assessment. For permission details, refer to RBAC permissions reference.

Enable SBOM generation

SBOM analysis requires both implicit security assessment and the Syft SBOM security tool to be enabled for your organization.

To enable SBOM analysis:

  1. Select an organization from the organization selector.

  2. Select Security  Marketplace.

  3. Enable Implicit security assessment if not already active.

  4. Locate and activate the Syft SBOM security tool.

  5. Configure binary security analysis to trigger SBOM generation.

Once enabled, SBOM generation occurs automatically during binary security analysis for every binary artifact your workflows produce.

Understanding SBOM generation

SBOM creation integrates with binary security analysis workflows, generating dependency inventories whenever binary artifacts are scanned for security vulnerabilities.

SBOM generation triggers when:

  • Workflows complete successfully with artifact publication steps that include SBOM-compatible binary files.

  • Binary security analysis processes container images, executable files, or packaged applications.

  • ECR integration automatically scans container images pushed to AWS Elastic Container Registry.

The SBOM generation process:

  1. Analyzes binary artifacts to identify all included software components.

  2. Maps direct dependencies declared in package manifests.

  3. Discovers transitive dependencies included in compiled or packaged artifacts.

  4. Generates comprehensive dependency inventories in the standardized CycloneDX format.

  5. Links SBOM data to security vulnerability analysis for correlation.

Configure SBOM vulnerability scanning

Enhance SBOM analysis by enabling vulnerability scanning of identified dependencies using the Grype security tool.

To configure SBOM vulnerability scanning:

  1. From the Marketplace, ensure both Syft SBOM and Grype security tools are activated.

  2. Configure binary security analysis workflows to include both SBOM generation and vulnerability scanning.

The Grype tool scans SBOM data for known vulnerabilities in dependencies, providing security context for software supply chain risk assessment.

Vulnerability findings from SBOM analysis appear in the component security center alongside other security analysis results.

Access and export SBOM data

Review and export SBOM data for compliance reporting, supply chain analysis, and security assessment purposes.

To access SBOM information:

  1. Select an organization from the organization selector.

  2. Select Components, then select a component with binary artifacts.

  3. Navigate to the security summary section.

You can export SBOM data in CycloneDX format, the industry-standard SBOM format for tool integration and compliance frameworks.

Export capabilities support compliance requirements, security audits, and integration with external software composition analysis tools.

Maintain SBOM currency

SBOM data remains current through automatic regeneration triggered by binary artifact changes and security analysis updates.

SBOM updates occur when:

  • New binary artifacts are produced by workflow execution.

  • Existing artifacts are rebuilt with updated dependencies.

  • Security scanning detects changes in dependency vulnerability status.

  • Package managers resolve different dependency versions during builds.

Current SBOM data reflects the most recent binary artifact analysis for each component, ensuring dependency visibility remains accurate as software evolves.

Integration and compliance considerations

SBOM analysis supports various compliance frameworks and integration scenarios for enterprise software supply chain management.

Compliance framework support:

  • Executive Order 14028 requirements for software supply chain security.

  • NIST Cybersecurity Framework software component identification.

  • ISO/IEC 27001 software asset management requirements.

Integration capabilities:

  • CycloneDX export format enables integration with external compliance and risk management tools.

  • SBOM data correlates with security vulnerability findings for comprehensive risk assessment.

  • Component-level SBOM visibility supports detailed software composition analysis across application portfolios.

Operational considerations:

  • SBOM generation adds minimal overhead to existing binary security analysis workflows.

  • Large applications with complex dependency trees may produce substantial SBOM data requiring appropriate storage and analysis tooling.

  • Regular SBOM export and archival supports historical compliance documentation and audit trail maintenance.

Related pages

Configure implicit security analysis
Define security SLAs