Skip to main content
Version: 1.5

SBOM reports

You can upload SBOM reports for security checks with the following tools:

  • KCS;
  • OWASP Dependency-Track;
  • Trivy;
  • Grype;
  • CodeScoring SCA;
  • Solar AppScreener SCA.

The system supports uploading SBOM reports in the following formats:

  • SPDX;
  • CycloneDX.

Upload an SBOM report​

To upload an SBOM report, follow these steps:

  1. Go to Projects → Project name → Security layers.
  2. Select the required project from the list.
  3. Go to the Security layers tab.
  4. Select the more actions button (More actions) next to the security check.
  5. Select Import SBOM.
  6. In the window that opens, upload the report's JSON file in one of the supported formats.
  7. Select Save.

A notification that the SBOM upload has started appears in the interface. The upload takes some time.

note

For more information about exporting reports from security tools or using the command line, see CLI tools.

SBOM report processing statuses​

SBOM report uploads can have the following statuses:

  1. After you upload the report, its status changes to In progress.
  2. After the system processes the report successfully, its status changes to Processed, and a link to the discovered dependencies appears in the Dependency library section.

The SBOM report upload status appears for each security check in Projects → Project name → Security layers.

You can find the complete list of dependencies in Dependencies.

Examples of exporting reports​

Export a report from CodeScoring​

To export a report from CodeScoring, follow these steps:

  1. Sign in to CodeScoring.
  2. Go to SCA → Projects → Project name.

Export an SBOM from CodeScoring

  1. Select Export SBOM.
  2. Select one of the available versions.

Export an SBOM from CodeScoring

  1. Upload the SBOM report to TRON.ASOC by following the instructions in Upload an SBOM report.

Export a report from PT AI​

To export a report from PT AI, follow these steps:

  1. Sign in to PT AI.
  2. Go to Projects.

Export an SBOM from PT AI

  1. Go to the detailed information page for the selected project.
  2. Select Release report.

Export an SBOM from PT AI

  1. In the Release report window, select the Report in JSON format report template.

Export an SBOM from PT AI

  1. Select Release.
  2. Upload the report to TRON.ASOC by following the instructions in Upload an external report.