SBOM Export

After an Xray scan, you can export a Software Bill of Materials (SBOM) using industry-standard formats. Exports include component inventory, license data, and optional security context depending on the format and options.

How to Export an SBOM Report

1. Navigate to the Scans List in Xray.
2. Select a resource version scan from the list.
3. Click the [...] (More Options) button.
4. Select Export Scan Data and choose SBOM with your preferred format.

Supported SBOM Formats

1. SPDX (Software Package Data Exchange)

SPDX is an industry-standard format for communicating software components and license metadata.

• Useful for license management and compliance tracking.
• Supports open-source compliance reporting.

SPDX export formats:

• SPDX 2.3: The default format. Export options are Tag:Value, JSON, and XLSX.
• SPDX 3.0: Export options are JSON and XLSX.

2. CycloneDX

CycloneDX is a lightweight SBOM format designed for software security and risk analysis.

• Focuses on security, vulnerability tracking, and exploitability.
• CycloneDX SBOMs also include VEX (Vulnerability Exploitability Exchange) data, providing
  • Vulnerability details
  • Exploitability status
  • Technical analysis of risks
• CycloneDX SBOM exports can include Cryptography Bill of Materials (CBOM) data. For more information, see CBOM Export.

CycloneDX export formats:

• JSON
• XML