> For the complete documentation index, see [llms.txt](https://docs.opsmx.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.opsmx.com/code-to-cloud-security-and-scanners/code-security/sbom/how-to-do-sbom-scan.md).

# How to do SBOM Scan

The SBOM (Software Bill of Materials) Scan enables you to generate and analyze a comprehensive inventory of all open-source and third-party components used in your software artifacts. It supports both automated scanning from configured repositories and manual upload of pre-generated SBOM files in standard formats (CycloneDX, SPDX).

By integrating OpsMx Delivery Shield with your artifact pipeline, the SBOM Scan provides continuous visibility into your software supply chain — identifying licensing risks, outdated dependencies, and known vulnerabilities across all tracked components.

## To Access SBOM Scan

* Navigate to **Scan Now** > **SBOM Scan**.

Now you can Add Project, Upload Project **or** Sync Project to proceed with the scan.

## To Add a Project

* To add or update a new project with source scan configurations, for scanning, click **Add Project**.
* The Create Project details page is displayed as shown below. 
* Enter the details for the following fields:
  * **Name** - Enter a unique name to identify this SBOM scan project.
  * **Team** - Select the team that owns or is responsible for this project.
  * **SBOM Tool** - Select the SBOM generation tool used to produce the bill of materials (e.g.,SBOM Generation, Container Security Scan, CycloneDX CLI).
  * **Scan Type** - Select the type of scan to be performed. The default value is **SBOM Scan**.
  * **Workspace / Repository** - Select the workspace or repository containing the target artifact.
  * **Artifact Configuration**:
    * **Artifact Name** - Enter the name of the artifact (e.g., container image name, package name).
  * **Artifact Tag** - Enter the version tag of the artifact.
  * **Upload SBOM File** - Click **Upload SBOM** to manually upload a pre-generated SBOM file (CycloneDX JSON/XML or SPDX).
* Click **Save.**

The project gets added for scanning.

## To Upload a Project

* To upload a project from your local, for scanning, click **Upload Project**.
* Click **Upload File** and select the sbom file that you want to add for scanning.
* Click **Save**.

The file gets added for scanning.

## Saving Configuration

* After adding the configuration details you can click the **Save Configuration** option to save the adding details and trigger the scan at a later period.
* The added project displays in the list with a **Paused** scan status.
* When you want to scan the saved project you can click the Trigger Scan option to initiate the scan.

## To Integrate JIRA at Project Level

JIRA can be integrated at project level to create tickets whenever an alert is identified.

* To integrate JIRA, click the Integrations icon on expanding the project.
* The JIRA integration page is displayed. Click **Add Account** and enter the details.
  * **Account Name** - Enter the JIRA account name.
  * **Jira Project Key** - Enter the name of your Jira project.
  * **Jira** URL - Enter your Jira host Url
  * **Jira Email Id** - Enter the username to access Jira.
  * **Token** - Enter the password / token for the Jira account.
* Enable **Automatically create Jira tickets during the scan** to create JIRA ticket to the team owner when the alerts are identified.
* **Trigger Type** - Indicates at which level Jira tickets should be created.
  * **Create Jira ticket at the Component Alert level** - Jira tickets will be created for each individual impacted component.
  * **Create Jira ticket at the Deduplication Alert level** - A single Jira ticket will be created for all the impacted components.
* **Creation Scope** - If Vulnerabilities is selected, Jira is created only for Critical and High alerts. If All Policies is selected Jira is created for all alerts.
* Enable **Assign the Jira ticket to the Team owner** if you want to assign the ticket to the team owner.
  * Fields - Enter the labels that need to be added in the created Jira ticket.
  * Values - Enter the values that need to be given in the Jira ticket. The given variables are replaced with actual values when the tickets are created.
* **Status Keyword Mapping** - You can set the keywords for the status.
* Click **Test** to check if the entered values are valid.
* Once validated, click **Save**. The tool is connected.

## To View and Interpret Scan Results 

* Once the scan is complete, OpsMx generates the overall results and they are displayed as shown below:

  * Repos Registered
  * Total Branches
  * Total Scans
  * Total Projects
  * Auto Scan Enabled Repos

  Enable the **Latest Scan** toggle button to view only the most recent scans.
* The panel at the bottom displays the project details. On expanding each project you can view the complete details of it.
* Click **View Reports** to view the various reports related to the scan.The current status of the scan (completed, pending or failed) is displayed to notify the status of the project.
  * The page displays the findings for each scan. Click on the appropriate tab to view the results.
* On clicking the **Download** button, the scan results are downloaded in .json or .csv format.
* On clicking **Report**, the scan results are downloaded in a report format.
* On clicking **Go to Artifact Page**, you are redirected to the related artifact page.

## Quick Actions

Each project displays 5 quick action buttons as shown:

1. **Trigger Scan** – Initiates a new scan for the project or runs a scan using a previously saved configuration.
2. **Integrations** – Opens the project's **Integrations** page, where all available integrations for the project are listed.
3. **Policies** – Displays the list of policies that have been configured for the project.
4. **Edit Project** – Opens the project configuration settings, allowing you to modify the project's details and scan settings.
5. **Delete** – Removes the project from the system.

## Best Practices

To get the most out of OpsMx Delivery Shield Source Scan, consider following these best practices:

* **Frequent Scanning**: Run the scans regularly (e.g., after each commit or weekly) to detect the vulnerabilities early.
* **CI/CD Pipeline Integration**: Incorporate source scanning into your continuous integration/continuous deployment pipeline to identify the issues before they go live.
* **Alerts and Notifications**: Set up alerts to notify your team when critical vulnerabilities are detected, to address them promptly.
* **Fixing Issues in Advance**: Address vulnerabilities as soon as they are found to prevent issues from piling up.

## Troubleshooting

If you encounter any issues during or after the scan, check the following:

* Connection Issues with Bitbucket:
  * Ensure that the correct authentication methods (OAuth, API tokens, SSH) are set up properly.
* Verify that the OpsMx account has the necessary permissions to access the Bitbucket repository.
* Check for bitbucket url whitelisting in supplychain api configmap.