Content:
Is a listing of all SBOMS sorted with newest on top.
The SBOMs table displays all SBOMs the current team has permission to see. If the user performs a search (filter), the table displays the results from the search.
+Upload button: to manually upload an SBOM (Software Bill-of-Materials) in the CycloneDX format (more info below).
+Create button: to manually create an SBOM from external artifacts registered in SBOM Central (more info below).
Heading | Description |
---|---|
Name | The name (label) of the SBOM, and a link to the SBOMs show page. |
Component | The component identity. |
Version | The version of the component. |
Build time | The time the SBOM was created. |
Delivered | Displays whether the SBOM has a delivery report. |
Tags | The tags on the SBOM. |
Icon | |
Compare | Select button for a comparison (see below). |
Filter by | Description |
---|---|
Search | Search the Name of an artifact. |
component | Select component to narrow the search. |
state | Select state of the build to narrow the search. |
deliveries | Select whether a the artifact has delivery reports to narrow the search. |
tags | Select one or more tags to narrow the search. |
start date | Select a start date to narrow the search. |
end date | Select a end date to narrow the search. |
Compare two SBOMs (of the same type) by pushing the compare select buttons in the SBOMs table.
A new windows is opened on top, specifying the SBOMs to be compared. When two SBOMs are selected: push the compare button to open a new SBOM Diff page, showing the differences.
Push the upload button to manually upload an SBOM.
Select/Edit | Description |
---|---|
Sbom | Browse your file system to select an SBOM file. |
Tags | Select or/and create tags for the SBOM. |
Vendor | Input vendor name to override name in SBOM. |
Component | Input component name to override name in SBOM. |
Version | Input version name to override version in SBOM. |
Timestamp | Input timestamp to override creation time in SBOM. |
Push the create button to manually create an SBOM.
Select/Edit | Description |
---|---|
Vendor | Vendor name for the SBOM |
Name | SBOM component/product name. |
Version | SBOM version. |
Build-time | SBOM creation time. |
Tags | Add tags to the SBOM |
Select artifact | Select artifacts to be included (must be registered in SBOM Central). Start editing artifact name to open a selection list. |
Artifacts | A list of all artifacts included into the SBOM |
The SBOM show page contains information and references related to one specific SBOM.
The page has the following main areas:
Color coded status boxes:
Box | Description |
---|---|
Build status | SBOM upload Success or Failed. |
Since last delivery | Time since the Delivery report was created. |
Licenses not decided on | Number of licenses to evaluate and decide action/Total number of licenses. |
Vulnerabilities not analyzed | Number of vulnerabilities to evaluate and decide action/Total number vulnerabilities. |
Vulnerabilities must be fixed | Number of vulnerabilities to manage (fix). |
Colors:
Name | Description |
---|---|
Comparison | Comparing data in this Build with data in an earlier Build and presentation of the differences. |
Deliveries | Create a delivery report for this SBOM, a listing of existing reports. |
Vulnerabilities | A list of vulnerabilities detected in this SBOM. |
External artifacts | A list of artifacts included in/related to this SBOM. |
Licenses | A list of licenses included in/related to this SBOM. |
BOMs | A list of SBOM files for this SBOM-report. |
SBOM data | Raw SBOM header data. |
History | A list of manual changes of data in WebApp related to this SBOM. |
Previous
Previous delivered
Comparing data in this SBOM with data in an earlier SBOM and presentation of the differences.
Sections in the page:
Previous buttons to select one of two types of SBOM to compare with:
Dependency buttons to select the amount of dependencies to visualize.:
Advanced diff button to open a new page to compare this build with any other build, SBOM diff.
Header | Description |
---|---|
Component | Icon and identity of the component, and a link to component pages in MAIA. External components are described in the package url format. About package url (external link). |
From | Version before this build. Link to 1) a component build report with this version, or 2) a external component show page. |
To | Version after this build, and links. |
Changes | Tags describing the changes. Version (blue): Component with version change. Component removed (orange): Component is not included anymore. Component added (orange): New component included. |
Same as the previous section for components that are used in compile time.
Necessary permissions to create a delivery report: Create/Update delivery reports and Update issues.
When an SBOM has a delivery report generated by the WebApp, it's regarded as Delivered by SBOM Central.
Sections in the tab:
When pushing the Create report button a pop-up window with a form for report editing.
The table lists all reports created for this SBOM.
Heading:
Open the report page by clicking the label. The page has four tabs and an information box:
Reason for delivery.
Delivery report versions.
Table containing all versions of the delivery report.
Heading:
Reports related to the delivery.
Heading:
History.
Information box, with Edit, Delete and Generate VEX buttons
The Vulnerabilities tab contains an index page listing all vulnerabilities detected for this SBOM.
Sections in the page:
Filter by | Description |
---|---|
Search | Search the Name of an artifact or CVE-id. |
Backend | Filter by backend data provider: NVD or OSV. |
Analyzed | Filter on: analyzed. |
Missing alias | Filter on Missing alias, i.e. OSV and NVD are not in sync regarding analtytics. |
Action | Filter on decided action: fix/don't fix |
Due date | Filter on due dates: 1Month/2 Months/3 Months |
Usage | Deliverable, Compile time, Runtime, Test. |
Shows the number of Vulnerabilities for each Priority.
A listing of all vulnerabilities identified in this build.
Header | Description |
---|---|
Identifier | Vulnerability identity, CVE-id or other, and a link to the local vulnerability show page containing detailed information and analysis tools. |
Priority | Priority set by a manual decision or by an automated rule. |
Added date | Date when the vulnerability was added to the WebApp. |
Analysis | The result of a analysis. |
Action | Decided action. |
Due date | The due date (if any) |
Artifact | Name of the artifact and link to the detailed artifact info , in package url format. About package url (external link). |
Artifact status | Health status for the artifact. |
Used in | Deliverable, Compile time, Runtime, Test. |
Lists all external artifacts included in this SBOM.
Filter by | Description |
---|---|
Search | Search artifact name(s). |
Type | Software/OS-Firmware/Hardware |
Package type | Filter by type of artifact e.g. generic, gem, npm, etc. |
License approval | Filter on has approved, disapproved, etc. |
License | Filter on has license/has no license |
Vulnerabilities | Filter to show vulnerable artifacts within priority categories. |
Usage | Filter on usage Deliverable/Compile time/Real time/Test. |
Status tags | Filter on a set of status tags. |
Header | Description |
---|---|
Name | Name and version of the artifact and link to detailed artifact info, in package url format. About package url (external link). |
Status | Artifact status described with a set of tags (see below). |
Vulnerabilities | A colored text indicating the highest priority on an existing vulnerability detected for the artifact. Link to open an inline table with a list of vulnerabilities. |
Licenses | Licenses identified for the artifact. Light blue icon= approved, Grey=to be analyzed, Red=not approved |
Used in | Deliverable/Compile time/Real time/Test |
By artifact | Used by artifact. |
Header | Description |
---|---|
Identifier | Vulnerability identity, CVE-id or other, and a link to the local [vulnerability show page]() containing detailed information and analysis tools. |
Priority | Priority set by a manual decision or by an automated rule. |
Added date | Date when the vulnerability was added to the WebApp. |
Analysis | The result of analysis. |
Action | Action fix / don't fix. |
Due date | The due date (if any) |
The Licenses tab contains a list of all artifacts sorted on license type.
One table for each license type
Header | Description |
---|---|
Artifact | Name of the artifact and link to the detailed artifact info , in package url format. About package url (external link). |
Approval | Approval status: Approved/Disapproved/undecided with icons. |
Source | License source: SBOM/Link/Manual ... from an SBOM/downloaded through a link/manually created |
Present in | Deliverable / Compile time |
The History tab is a list of changes performed in the WebApp UI.