endor-sbom

You can export an SBOM in CycloneDX or SPDX format by running the endorctl command with your project UUID and specifying the desired format and output file. This generates a standardized software bill of materials file.

You can compare SBOMs across releases to detect dependency drift by importing multiple software bill of materials files. This highlights component changes and helps assess license risk and compliance variations.

The best way to analyze vulnerabilities and licenses from an external SBOM is to import the file into the system. This processes the software bill of materials to present component-level insights including security and compliance details.

Yes, you can verify consistent component inventories across multiple repositories by generating and comparing SBOMs for each project. This drift detection ensures uniform software supply chain transparency and compliance.

Yes, you need to run a repository scan to create or update the SBOM before exporting. This initial scan populates the inventory required to generate an accurate software bill of materials.

An SBOM is a software bill of materials that lists component inventories. Managing it helps teams gain visibility into software components, enabling drift detection, license risk assessment, and improved security posture and compliance.