Export Scan Results

The JFrog Security platform allows you to export your scan results to simplify identification, assessment, and prioritization of vulnerabilities in your code and dependencies.

1. Navigate to Xray → Scans List.
2. Under the Git Repositories tab, select a scanned repository.
3. Select either the Commits or Pull Requests tab.
4. Select a scan you wish to export.
   The overview window opens.
5. On the top, right-hand side of the page, click on the three-dot menu and select Export Scan Data.
   The Export Scan Data window opens.

The Export Scan Data window has three tabs: Security, Legal, and SBOM.

Security export

On the Security tab, select the content you want to export:

• Policy Violations — export violations triggered by Xray Watches and Policies. To include violations that were ignored or suppressed, select Include Ignores under Policy Violations.
• License Report
• CVEs
• Operational Risk
• Secrets
• SAST

Select a file format:

• PDF
• CSV
• JSON

Click Export.

Legal export

On the Legal tab, export license and compliance data for the scanned repository.

SBOM export

On the SBOM tab:

1. Under SBOM Standard, select CycloneDX or SPDX.
2. Optionally select additional content:
   • Multiple license resolution
   • Vulnerabilities (VEX)
   • CBOM
3. Choose a format: XML or JSON.
4. Click Export.

For SBOM format details and field descriptions, see Export Scan Results.