Source Scan Artifacts

The Source Scan Artifacts page gives you a centralized view to monitor and manage the security posture of all source scan artifacts. From here, you can assess risks, review detailed scan reports, and take timely action to remediate vulnerabilities.

• Navigate to Security Issues -> Source Scan Artifacts.

• The panel at the top displays the total number of artifacts in the application, and the risk status of the artifacts.

  • Critical Risk - The artifacts that are of critical risk.

  • High Risk - The artifacts that are of high risk.

  • Medium Risk - The artifacts that are of medium risk.

  • Low Risk - The artifacts that are of low risk.

The panel below displays the various details of the artifacts.

• Artifact: The name or identifier of the specific artifact being scanned.

• Artifact Version: The version number or tag of the artifact (e.g., commit hash, build tag).

• Semantic Tags: Labels applied to an artifact that follow versioning conventions (e.g., v1.2.3) or convey its current state (e.g., latest, stable).

• Artifact SHA: A unique cryptographic hash (such as SHA-256) used to identify and verify the exact contents and integrity of the artifact.

• Stage: The current lifecycle stage of the artifact (e.g., Generated / Not Deployed).

• Source Repository: The origin version control system repository (e.g., GitHub, GitLab) where the code used to build the artifact is stored.

• Branch: The specific version control branch (e.g., main, develop) from which the artifact's source code was compiled or built.

• DBOM Status: The current state or availability of the Deployment Bill of Materials, which tracks the dependencies and components associated with deploying the artifact.

• Open Issues: The count and severity of active security issues or vulnerabilities found in the artifact.

• Vulnerability: The risk level or vulnerability status associated with the scan results.

• Created On: The timestamp or date when the artifact or scan report was generated.

• Team: The group or team responsible for managing or owning the artifact.

• Built by: Information regarding who or what pipeline built the artifact.

• Actions - On clicking the three dots, you can view the list of scans run on the artifact as shown below:

You can download the scan results by clicking on it.

Viewing SBOM for Artifacts

The SBOM for listed artifacts can be viewed by clicking the View SBOM option as shown below:

On clicking View SBOM, the SBOM page is displayed.

It displays the various components and related details of the components as shown below:

• Component - Displays the associated components of the artifacts.

• Version - Displays the version details of the component.

• Package URL - Displays the package URL of the component.

• License - Displays the list of licenses that are available for the component.

• Vulnerabilities - Displays the count of vulnerabilities related to the component.

• Reports - The OSS Risk report is displayed. On clicking it, the associated OSS risk page for the artifact is displayed.

• Actions - On clicking Edit License, you can edit the license type.

• You can view the vulnerabilities of the components by clicking the Vulnerabilities column.

• You can download the SBOM details in .json or .csv format by clicking the SBOM File button.

• You can download the SBOM details in report format (.pdf or .html) by clicking the SBOM Report button.

SBOM, CBOM, AIBOM and QBOM

The SBOM, CBOM and QBOM for the artifacts can be accessed from the Reports column.

The icons are displayed in the Reports column.

• SBOM - This displays the individual SBOM (Software Bill of Materials) details for the corresponding artifact.

• Compare - This displays the SBOM (Software Bill of Materials) comparison page for the corresponding artifact.

• CBOM - This displays the CBOM (Cryptography Bill of Materials) page for the corresponding artifact, showing its associated cryptographic components and details.

• QBOM - Within the CBOM page, you can download the QBOM (Quantum Bill of Materials) for the corresponding artifact. QBOM provides visibility into an organization's cryptographic assets, flags quantum-vulnerable algorithms, tracks post-quantum cryptography adoption, and captures metadata required for CERT-In compliance.

• AIBOM - This displays the AIBOM (AI Bill of Materials) page for the corresponding artifact.

• OSS Risk - This displays the OSS (Open Source Software) Risk page of the corresponding artifact.