Skip to main content
Version: 1.6

SBOM reports

You can upload SBOM reports for security scans from the following tools:

  • KCS;
  • OWASP Dependency-Track;
  • Trivy;
  • Grype;
  • CodeScoring SCA;
  • Solar AppScreener SCA;
  • PT AI.

The system supports uploading SBOM reports in the following formats:

  • SPDX;
  • CycloneDX.

Upload an SBOM report​

To upload an SBOM report, follow these steps:

  1. Go to Projects → Project name → Security layers.
  2. Select the required project from the list.
  3. Go to the Security layers tab.
  4. Select the additional actions button (Additional actions) next to the security scan.
  5. Select Import SBOM.
  6. In the window that opens, upload the report's JSON file in one of the supported formats.
  7. Select Save.

After that, the interface displays a notification that the SBOM upload has started. The upload takes some time.

note

For more information about exporting reports from security tools or using the command line, see CLI tools.

SBOM report processing statuses​

SBOM report uploads can have the following statuses:

  1. After you upload the report, the SBOM report status changes to In progress.
  2. After the report is processed successfully, its status changes to Processed, and a link to the detected dependencies appears in the Dependency library section.

The SBOM report upload status appears for each security scan in Projects → Project name → Security layers.

You can find the complete list of dependencies in Dependencies.

Examples of exporting reports​

Export a report from CodeScoring​

To export a report from CodeScoring, follow these steps:

  1. Sign in to CodeScoring.
  2. Go to SCA → Projects → Project name.

Export an SBOM from CodeScoring

  1. Select Export SBOM.
  2. Select one of the available versions.

Export an SBOM from CodeScoring

  1. Upload the SBOM report to TRON.ASOC by following the instructions in Upload an SBOM report.

Export a report from PT AI​

To export a report from PT AI, follow these steps:

  1. Sign in to PT AI.
  2. Go to Projects.

Export an SBOM from PT AI

  1. Go to the detailed information page for the selected project.
  2. Select Release report.

Export an SBOM from PT AI

  1. In the Report release window, select the JSON report report template.

Export an SBOM from PT AI

  1. Select Release.
  2. Upload the report to TRON.ASOC by following the instructions in Upload an external report.