Skip to main content
Version: 1.5.2

SBOM reports

You can upload SBOM reports for security scans with the following tools:

  • KCS;
  • OWASP Dependency-Track;
  • Trivy;
  • Grype;
  • CodeScoring SCA;
  • Solar AppScreener SCA.

The system supports uploading SBOM reports in the following formats:

  • SPDX;
  • CycloneDX.

Upload an SBOM report​

To upload an SBOM report, follow these steps:

  1. Go to Projects → Project name → Security layers.
  2. Select the required project from the list.
  3. Go to the Security layers tab.
  4. Select the additional actions button (Additional actions) next to the security scan.
  5. Select Import SBOM.
  6. In the window that opens, upload the report's JSON file in one of the supported formats.
  7. Select Save.

After that, the interface displays a notification that the SBOM upload has started. The upload might take some time.

note

For more information about exporting reports from security tools or using the command line, see CLI tools.

SBOM report processing statuses​

SBOM report uploads can have the following statuses:

  1. After you upload the report, its status changes to In progress.
  2. After the system processes the report successfully, its status changes to Processed, and the Dependency library section displays a link to the dependencies it found.

The SBOM report upload status appears for each security scan in Projects → Project name → Security layers.

You can find the complete list of dependencies in Dependencies.

Report export examples​

Export a report from CodeScoring​

To export a report from CodeScoring, follow these steps:

  1. Sign in to CodeScoring.
  2. Go to SCA → Projects → Project name.

Export an SBOM from CodeScoring

  1. Select Export SBOM.
  2. Select one of the available versions.

Export an SBOM from CodeScoring

  1. Upload the SBOM report to TRON.ASOC by following the instructions in Upload an SBOM report.

Export a report from PT AI​

To export a report from PT AI, follow these steps:

  1. Sign in to PT AI.
  2. Go to Projects.

Export an SBOM from PT AI

  1. Go to the detailed information page for the selected project.
  2. Select Generate report.

Export an SBOM from PT AI

  1. In the Generate report window, select the JSON report report template.

Export an SBOM from PT AI

  1. Select Generate.
  2. Upload the report to TRON.ASOC by following the instructions in Upload an external report.