> For the complete documentation index, see [llms.txt](https://docs.opsmx.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.opsmx.com/code-to-cloud-security-and-scanners/code-security/sbom/how-to-do-sbom-scan.md).

# How to do SBOM Scan

The SBOM (Software Bill of Materials) Scan enables you to generate and analyze a comprehensive inventory of all open-source and third-party components used in your software artifacts. It supports both automated scanning from configured repositories and manual upload of pre-generated SBOM files in standard formats (CycloneDX, SPDX).

By integrating OpsMx Delivery Shield with your artifact pipeline, the SBOM Scan provides continuous visibility into your software supply chain — identifying licensing risks, outdated dependencies, and known vulnerabilities across all tracked components.

### To Access SBOM Scan <a href="#user-content-to-access-sbom-scan" id="user-content-to-access-sbom-scan"></a>

* Navigate to **Scan Now** > **SBOM Scan**.

<figure><img src="/files/fL3g935gr9vSqlBBKacY" alt=""><figcaption></figcaption></figure>

Now you can **Add Project, Upload Project** or **Sync Project** to proceed with the scan.

### To Add a Project  <a href="#to-add-a-project" id="to-add-a-project"></a>

* To add or update a new project with source scan configurations, for scanning, click **Add Project**.

<figure><img src="/files/ho1cUNDyoMHBHX3fVH2X" alt=""><figcaption></figcaption></figure>

* The **Create Project** details page is displayed as shown below. Enter the details for the following fields:

<figure><img src="/files/XrWaP0pFOFHzSzH3qRr6" alt=""><figcaption></figcaption></figure>

* **Name** - Enter a unique name to identify this SBOM scan project.
* **Team** - Select the team that owns or is responsible for this project.
* **SBOM Tool** - Select the SBOM generation tool used to produce the bill of materials (e.g.,Syft, Trivy, CycloneDX CLI).
* **Scan Type** - Select the type of scan to be performed. The default value is **SBOM Scan**.
* **Workspace / Repository** - Select the workspace or repository containing the target artifact.
* **Artifact Configuration**:
  * **Artifact Name** - Enter the name of the artifact (e.g., container image name, package name).
  * **Artifact Tag** - Enter the version tag of the artifact.
* **Upload SBOM File** - Click **Upload SBOM** to manually upload a pre-generated SBOM file (CycloneDX JSON/XML or SPDX).
* Click **Save.**

The project gets added for scanning.

### To Upload a Project <a href="#to-upload-a-project" id="to-upload-a-project"></a>

* To upload a project from your local, for scanning, click **Upload Project**.

<figure><img src="/files/N5Lhp1H79jynlMiWJyP7" alt=""><figcaption></figcaption></figure>

* Click **Upload File** and select the sbom file that you want to add for scanning.

<figure><img src="/files/YUGlDS0zOoO9vB7IcMf5" alt=""><figcaption></figcaption></figure>

* Click **Save**.

The file gets added for scanning.

### Saving Configuration  <a href="#saving-configuration" id="saving-configuration"></a>

* After adding the configuration details you can click the **Save Configuration** option to save the adding details and trigger the scan at a later period.
* The added project displays in the list with a **Paused** scan status.
* When you want to scan the saved project you can click the Trigger Scan option to initiate the scan.

### To Integrate JIRA at Project Level <a href="#to-integrate-jira-at-project-level" id="to-integrate-jira-at-project-level"></a>

JIRA can be integrated at project level to create tickets whenever an alert is identified.

* To integrate JIRA, click the Integrations icon on expanding the project.
* The JIRA integration page is displayed. Click **Add Account** and enter the details.
  * **Account Name -** Enter the JIRA account name.
  * **Jira Project Key -** Enter the name of your Jira project.
  * **Jira** **URL -** Enter your Jira host Url
  * **Jira Email Id -** Enter the username to access Jira.
  * **Token -** Enter the password / token for the Jira account.
  * Enable **Automatically create Jira tickets during the scan** to create JIRA ticket to the team owner when the alerts are identified.
  * **Trigger Type** - Indicates at which level Jira tickets should be created.
    * **Create Jira ticket at the Component Alert level** - Jira tickets will be created for each individual impacted component.
    * **Create Jira ticket at the Deduplication Alert level** - A single Jira ticket will be created for all the impacted components.
    * **Creation Scope** - If Vulnerabilities is selected, Jira is created only for Critical and High alerts. If All Policies is selected Jira is created for all alerts.
  * Enable **Assign the Jira ticket to the Team owner** if you want to assign the ticket to the team owner.
  * **Fields -** Enter the labels that need to be added in the created Jira ticket.
  * **Values -** Enter the values that need to be given in the Jira ticket. The given variables are replaced with actual values when the tickets are created.
  * **Status Keyword Mapping** - You can set the keywords for the status.
* Click **Test** to check if the entered values are valid.
* Once validated, click **Save**. The tool is connected.
* To View and Interpret Scan Results&#x20;

  Once the scan is complete, OpsMx generates the overall results and they are displayed as shown below:

  * Repos Registered
  * Total Branches
  * Total Scans
  * Total Projects
  * Auto Scan Enabled Repos

  Enable the **Latest Scan** toggle button to view only the most recent scans.

  * The panel at the bottom displays the project details. On expanding each project you can view the complete details of it.
  * Click **View Reports** to view the various reports related to the scan.

  The current status of the scan (completed, pending or failed) is displayed to notify the status of the project.

  * The page displays the findings for each scan. Click on the appropriate tab to view the results.
  * On clicking the **Download** button, the scan results are downloaded in .json or .csv format.
  * On clicking Report, the scan results are downloaded in a report format.
  * On clicking Go to Artifact Page, you are redirected to the related artifact page.

### Quick Actions <a href="#quick-actions" id="quick-actions"></a>

Each project displays 5 quick action buttons as shown:

1. **Trigger Scan** – Initiates a new scan for the project or runs a scan using a previously saved configuration.
2. **Integrations** – Opens the project's **Integrations** page, where all available integrations for the project are listed.
3. **Policies** – Displays the list of policies that have been configured for the project.
4. **Edit Project** – Opens the project configuration settings, allowing you to modify the project's details and scan settings.
5. **Delete** – Removes the project from the system.

### Best Practices <a href="#best-practices" id="best-practices"></a>

To get the most out of OpsMx Delivery Shield Source Scan, consider following these best practices:

* **Frequent Scanning**: Run the scans regularly (e.g., after each commit or weekly) to detect the vulnerabilities early.
* **CI/CD Pipeline Integration**: Incorporate source scanning into your continuous integration/continuous deployment pipeline to identify the issues before they go live.
* **Alerts and Notifications**: Set up alerts to notify your team when critical vulnerabilities are detected, to address them promptly.
* **Fixing Issues in Advance**: Address vulnerabilities as soon as they are found to prevent issues from piling up.

### Troubleshooting <a href="#troubleshooting" id="troubleshooting"></a>

If you encounter any issues during or after the scan, check the following:

* Connection Issues with Bitbucket:
  * Ensure that the correct authentication methods (OAuth, API tokens, SSH) are set up properly.
  * Verify that the OpsMx account has the necessary permissions to access the Bitbucket repository.
  * Check for bitbucket url whitelisting in supplychain api configmap.