Skip to main content
Version: 1.5.1

SBOM reports

You can upload SBOM reports for security checks with the following tools:

  • KCS;
  • OWASP Dependency-Track;
  • Trivy;
  • Grype;
  • CodeScoring SCA;
  • Solar AppScreener SCA.

The system supports uploading SBOM reports in the following formats:

  • SPDX;
  • CycloneDX.

Upload an SBOM report​

To upload an SBOM report, follow these steps:

  1. Go to Projects → Project name → Security layers.
  2. Select the project you need from the list.
  3. Go to the Security layers tab.
  4. Select the additional actions button (Additional actions) next to the security check.
  5. Select Import SBOM.
  6. In the window that opens, upload the report's JSON file in one of the supported formats.
  7. Select Save.

You’ll see a notification that the SBOM upload has started. The upload will take some time.

note

For more information about exporting reports from security tools or using the command line, see CLI tools.

SBOM report processing statuses​

SBOM report uploads can have the following statuses:

  1. After you upload an SBOM report, its status changes to In progress.
  2. When the system processes the report successfully, its status changes to Processed, and a link to the discovered dependencies appears in the Dependencies library.

The upload status appears for each security check in Projects → Project name → Security layers.

You can find the complete list of dependencies in Dependencies.

Report export examples​

Export a report from CodeScoring​

To export a report from CodeScoring, follow these steps:

  1. Sign in to CodeScoring.
  2. Go to SCA → Projects → Project name.

Export an SBOM from CodeScoring

  1. Select Export SBOM.
  2. Select one of the available versions.

Export an SBOM from CodeScoring

  1. Upload the SBOM report to TRON.ASOC by following the instructions in Upload an SBOM report.

Export a report from PT AI​

To export a report from PT AI, follow these steps:

  1. Sign in to PT AI.
  2. Go to Projects.

Export an SBOM from PT AI

  1. Go to the detailed information page for the selected project.
  2. Select Release report.

Export an SBOM from PT AI

  1. In the Release report window, select the JSON report report template.

Export an SBOM from PT AI

  1. Select Release.
  2. Upload the report to TRON.ASOC by following the instructions in Upload an external report.