domains / families / security / generating-and-analyzing-sboms

generating-and-analyzing-sboms

separate

Generate CycloneDX and SPDX SBOMs from container images and filesystems with Syft, correlate them to CVEs with Grype, and sign/attest them with Cosign. Use when you need a machine-readable dependency inventory for supply-chain risk, want to scan images or SBOMs for known vulnerabilities, or are embedding SBOM generation and vulnerability gating into CI/CD.

When to use

• Establishing and maintaining a component inventory for applications and container images.
• Continuously detecting known vulnerabilities (including newly disclosed CVEs against existing artifacts).
• Satisfying procurement/regulatory SBOM requirements (CISA, EO 14028).
• Producing signed SBOM attestations for downstream supply-chain trust.

When not to use

• Generating and scanning SBOMs for software and images you do not own or are not authorized to assess

Skill page

Source