Skip to main content

Components (SBOM)

Path: /assets/components · Sidebar: Assets → Inventory → Components

Every open-source package, library and OS package discovered across your applications - the software bill of materials (SBOM) for your whole portfolio, with the vulnerabilities and licenses attached.

What you get​

  • Component inventory - name, version, ecosystem (npm, PyPI, Maven, Go, RubyGems, Cargo, OS packages…), and which applications use it.
  • Vulnerabilities per component - CVEs from OSV / CVE feeds, with fixed versions and reachability (is it actually imported, or just in the lockfile?).
  • Licenses - license per component, flagged against your policy (copyleft, unknown, denied).
  • Malicious / typosquat - packages flagged as supply-chain risks.

Why it matters​

When a new CVE drops (e.g. a Log4Shell-class issue), the Components view answers "are we affected, and where?" instantly - pivot from a component to every application and finding that carries it.

  • Blast radius - one vulnerable component → all impacted apps in one click.
  • Upgrade planning - see the fixed version and every place to bump.
  • License compliance - catch a denied license before it ships.

Components feed the unified Vulnerabilities view and the SCA scanners. Export an SBOM (CycloneDX/SPDX) from the reporting module.

Last updated on