License names that automatically will be assigned to this license type. The selection box is editable.
Recommendation
Recommendation setting for use of software with this license type: Approve/For internal use only/Deny.
Permissiveness
Public domain/Permissive/Weak copyleft/Copyleft/Proprietary.
Use template
Activate the template. Opens a text field for adding template text.
Template
Template license text.
Updated: 2024-12-04 SBOM Central
External artifacts has a Licenses tab in their show page. Licenses are often retrieved from uploaded SBOMs, or external data sources (websites), but you can also add licenses manually.
A modern CI/CD workflow has the potential to continuously generate SBOMs; however, only a select few are crucial for purposes such as releases, deliveries, traceability, and historical records.
In SBOM Central, these significant SBOMs are highlighted by creating a Delivery Report.
Open the SBOM show page in question
... and select the Deliveries tab.
Push Create report button
... to open the create dialog and add suitable information.
A Vulnerability Exploitability eXchange (VEX) is a type of security advisory, similar to those commonly issued by mature product security teams. The key distinction of the VEX model is that its reports are machine-readable, enabling seamless integration with security management tools and vulnerability tracking platforms. VEX data enhances the effective use of Software Bills of Materials (SBOM) data.
In SBOM Central, you can generate VEX reports for specific vulnerabilities and associated SBOMs from the list of deliveries with Delivery Reports. For details, see Why is VEX generation tied to Delivery Reports.
SBOMs are continuously monitored for newly discovered vulnerabilities, with automatic notifications triggered upon detection. Each identified vulnerability requires careful analysis and appropriate actions.
Open the vulnerability show page and push the Generate VEX button.
Select one of the analyses (or the none alternative) and then pick one or more deliveries from the list. The list content is depending on the first analysis selection. Push Save. The report will now be found in the Report section of SBOM Central.
Updated 2025-01-20 SBOM Central
A Vulnerability Exploitability eXchange (VEX) is a type of security advisory, similar to those commonly issued by mature product security teams. The key distinction of the VEX model is that its reports are machine-readable, enabling seamless integration with security management tools and vulnerability tracking platforms. VEX data enhances the effective use of Software Bills of Materials (SBOM) data.
In SBOM Central, you can generate VEX reports for specific vulnerabilities and associated SBOMs from the list of deliveries with Delivery Reports. For details, see Why is VEX generation tied to Delivery Reports.
The SBOM is actively monitored for newly discovered vulnerabilities, with notifications automatically triggered upon detection. Any detected vulnerability must be carefully analyzed, and appropriate actions decided upon. This analysis and decision-making process will be directly tied to the SBOM/Delivery Report and will form the foundation for generating a VEX report (see What are the use cases for duplicating an SBOM)
Open the SBOM show page and select the delivieries tab. Push the Generate VEX for the selected Delivery report.
Select the vulnerabilities that you want to be included into the VEX report and push Save. The report will now be found in the Report section of SBOM Central.
Updated 2025-01-20 SBOM Central
An Advisory report is a human readable version of the VEX report. When creating the advisory, content from the corresponding VEX is automatically imported.
Go to the Reports/VEX tab. Select a VEX report and push the Create advisory button.
The advisory creation dialog opens, containing a number of optional edit fields to add information to the report.
Title of the report
Description
Vendor
Equipment
Risk evaluation
Mitigations
Push Save. The Advisory Report is now visible in the Advisories tab.
Users and teams
Updated 2025-01-16 SBOM Central
You'll need appropriate permissions to do this.
Open Main menu/Teams page.
Select team.
Add/Remove members
Add/Remove members to/from the team.
In the Members tab, open Edit members pop-up window.
Add members to the team from the drop-down menu.
Remove members by clicking the member trash-cans.
Save
Configure team permissions
In the Team permissions tab, open Edit permissions pop-up window.
Select the permissions that will apply to all members of the team.
Configure user permissions
In the Members tab, edit individual permissions for any member of the team by clicking the Edit permissions for the member.
Configure components.
The Components tab is for manual component management i.e. adding/creating/deleting components to select the ones visible to the Team.
Use this page to manage components in the meaning of Products. A component in SBOM Central is a generic designation regarding various types of components where the External collection component is the SBOM Central technical term for a Product.
Products are automatically created and assigned to a Team when uploading SBOMs.
If the SBOM is manually uploaded, the Product is created for the Team the User is logged in to.
If uploaded through the RestAPI, the Product is created for the Team where the Token belongs.
By switching teams a user can access different subsets of information. A user can also access editing capabilities depending on the permissions of their team and the permissions they are given within the team.
