> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/discovering/importing-manifests/sbom.md).

# Uploading an SBOM

Uploading a Software Bill of Materials gives Seal a one-time view of the components in a built environment, without needing access to the source or the build pipeline. The Seal Project lands in [imported manifest discovery mode](/discovering/package-discovery-mode/imported-manifest.md). The snapshot does not refresh.

SBOM uploads are useful for:

* Assessing a vendor-supplied component you are evaluating.
* Standing up a Seal Project quickly for an environment whose build you do not own.
* Auditing an existing artifact you have a generated SBOM for.

## Supported formats

* **CycloneDX** in JSON, identified by `"bomFormat": "CycloneDX"` in the file.
* **SPDX** in JSON, identified by an `"SPDXID"` field.

XML SBOMs are not accepted. If your tooling produces XML, regenerate or convert to JSON before uploading.

## Steps

Follow the [shared Import from file flow](/discovering/importing-manifests.md#the-shared-flow). Drag your `.json` SBOM onto the upload area; the detector reads the file's contents to identify the format.

## Verify

The new Seal Project appears on the Projects page in **Imported manifest** discovery mode. Discovered packages appear on the Protection page's Vulnerable packages tab as the parser finishes.

For ongoing remediation of an SBOM-described environment, plan to switch to a higher-reliability discovery mode once you have the access to do so. The SBOM upload is a snapshot; new commits or vulnerabilities discovered after the upload do not refresh it.

## Related

* [Importing manifests & SBOMs](/discovering/importing-manifests.md): the parent overview.
* [Imported manifest mode](/discovering/package-discovery-mode/imported-manifest.md): coverage and refresh behavior.