Export an SBOM for a Running Image
JFrog Runtime lets you export a CycloneDX JSON SBOM for an individual running image from Live Assessment. The export reuses Xray scan data for the image so the SBOM reflects the components actually deployed in your environment—not just what is stored in Artifactory.
Use this export for audit evidence, GRC questionnaires, and customer security reviews. For SBOM export from Xray scan results in the Platform UI, see SBOM Export.
This capability exports a single running image only. Bulk or aggregated SBOM export across multiple running images is not supported.
Prerequisites
Before you export an SBOM, verify the following:
- The image is detected in Runtime > Live Assessment.
- The image has been indexed and scanned by Xray. Enable Automatic Security Scanning on the cluster if images are not scanned automatically.
- You have Runtime access to Live Assessment and permission to view the running image.
- You have Xray permission to export scan data for the underlying Artifactory artifact.
If you lack export permission, the Export SBOM action is hidden.
Supported Export Format
Runtime SBOM export supports CycloneDX JSON only.
On success, your browser downloads a file named [image-name]_[short-digest]_cyclonedx.json.
Export an SBOM from Live Assessment
To export a CycloneDX JSON SBOM for a running image:
- From the JFrog Platform, under Runtime, select Live Assessment.
- Select the Images tab.
- Export the SBOM using either entry point:
- From the image row: Open the row actions menu (kebab) and select Export SBOM.
- From the image details page: Select the image to open the detailed view, then select Export SBOM in the page header (to the left of Get More Insights).
- Wait while Runtime generates the SBOM. The button shows Generating SBOM… while the export is in progress.
- When the export completes, your browser downloads the CycloneDX JSON file and a success notification appears.
When Export SBOM Is Available
| State | Export SBOM behavior |
|---|---|
| Image scanned and indexed in Xray | Action is enabled. Click to download CycloneDX JSON. |
| Xray scan in progress | Action is disabled. Tooltip: Xray is still scanning this image. SBOM will be ready shortly — try again in a few minutes. |
| Image not indexed by Xray | Action is disabled. Tooltip: Xray hasn't indexed this image. Configure Xray scanning for this repository to enable SBOM export. |
| Missing export permission | Action is hidden. |
Troubleshooting
If export fails, Runtime shows a top-center notification with the failure reason.
| Message | Cause | What to do |
|---|---|---|
| Xray hasn't indexed this image. Configure Xray scanning for this repository to enable SBOM export. | Xray has no scan data for the artifact. | Enable Xray scanning for the repository. See Automatic Security Scanning. |
| You don't have permission to export this image's SBOM. | Your account lacks Xray export permission for the component. | Ask an administrator to grant the required Xray permissions. |
| Couldn't generate the SBOM. Please try again. If the issue persists, contact support. | Transient Xray error or timeout. | Select Retry on the notification, or try again later. |
For general image inspection workflows in Live Assessment, see Inspecting Live Software Components.
Updated 4 days ago