Uploading an SBOM

Upload a CycloneDX or SPDX SBOM as a one-shot snapshot of an environment.

Uploading a Software Bill of Materials gives Seal a one-time view of the components in a built environment, without needing access to the source or the build pipeline. The Seal Project lands in imported manifest discovery mode. The snapshot does not refresh.

SBOM uploads are useful for:

• Assessing a vendor-supplied component you are evaluating.

• Standing up a Seal Project quickly for an environment whose build you do not own.

• Auditing an existing artifact you have a generated SBOM for.

Supported formats

• CycloneDX in JSON, identified by "bomFormat": "CycloneDX" in the file.

• SPDX in JSON, identified by an "SPDXID" field.

XML SBOMs are not accepted. If your tooling produces XML, regenerate or convert to JSON before uploading.

Steps

Follow the shared Import from file flow. Drag your .json SBOM onto the upload area; the detector reads the file's contents to identify the format.

Verify

The new Seal Project appears on the Projects page in Imported manifest discovery mode. Discovered packages appear on the Protection page's Vulnerable packages tab as the parser finishes.

For ongoing remediation of an SBOM-described environment, plan to switch to a higher-reliability discovery mode once you have the access to do so. The SBOM upload is a snapshot; new commits or vulnerabilities discovered after the upload do not refresh it.

Related

• Importing manifests & SBOMs: the parent overview.

• Imported manifest mode: coverage and refresh behavior.