How to do SBOM Scan
The SBOM (Software Bill of Materials) Scan enables you to generate and analyze a comprehensive inventory of all open-source and third-party components used in your software artifacts. It supports both automated scanning from configured repositories and manual upload of pre-generated SBOM files in standard formats (CycloneDX, SPDX).
By integrating OpsMx Delivery Shield with your artifact pipeline, the SBOM Scan provides continuous visibility into your software supply chain — identifying licensing risks, outdated dependencies, and known vulnerabilities across all tracked components.
To Access SBOM Scan
Navigate to Scan Now > SBOM Scan.
Now you can Add Project, Upload Project or Sync Project to proceed with the scan.
To Add a Project
To add or update a new project with source scan configurations, for scanning, click Add Project.
The Create Project details page is displayed as shown below. Enter the details for the following fields:
Name - Enter a unique name to identify this SBOM scan project.
Team - Select the team that owns or is responsible for this project.
SBOM Tool - Select the SBOM generation tool used to produce the bill of materials (e.g.,Syft, Trivy, CycloneDX CLI).
Scan Type - Select the type of scan to be performed. The default value is SBOM Scan.
Workspace / Repository - Select the workspace or repository containing the target artifact.
Artifact Configuration:
Artifact Name - Enter the name of the artifact (e.g., container image name, package name).
Artifact Tag - Enter the version tag of the artifact.
Upload SBOM File - Click Upload SBOM to manually upload a pre-generated SBOM file (CycloneDX JSON/XML or SPDX).
Click Save.
The project gets added for scanning.
To Upload a Project
To upload a project from your local, for scanning, click Upload Project.
Click Upload File and select the sbom file that you want to add for scanning.
Click Save.
The file gets added for scanning.
Saving Configuration
After adding the configuration details you can click the Save Configuration option to save the adding details and trigger the scan at a later period.
The added project displays in the list with a Paused scan status.
When you want to scan the saved project you can click the Trigger Scan option to initiate the scan.
To Integrate JIRA at Project Level
JIRA can be integrated at project level to create tickets whenever an alert is identified.
To integrate JIRA, click the Integrations icon on expanding the project.
The JIRA integration page is displayed. Click Add Account and enter the details.
Account Name - Enter the JIRA account name.
Jira Project Key - Enter the name of your Jira project.
Jira URL - Enter your Jira host Url
Jira Email Id - Enter the username to access Jira.
Token - Enter the password / token for the Jira account.
Enable Automatically create Jira tickets during the scan to create JIRA ticket to the team owner when the alerts are identified.
Trigger Type - Indicates at which level Jira tickets should be created.
Create Jira ticket at the Component Alert level - Jira tickets will be created for each individual impacted component.
Create Jira ticket at the Deduplication Alert level - A single Jira ticket will be created for all the impacted components.
Creation Scope - If Vulnerabilities is selected, Jira is created only for Critical and High alerts. If All Policies is selected Jira is created for all alerts.
Enable Assign the Jira ticket to the Team owner if you want to assign the ticket to the team owner.
Fields - Enter the labels that need to be added in the created Jira ticket.
Values - Enter the values that need to be given in the Jira ticket. The given variables are replaced with actual values when the tickets are created.
Status Keyword Mapping - You can set the keywords for the status.
Click Test to check if the entered values are valid.
Once validated, click Save. The tool is connected.
To View and Interpret Scan Results
Once the scan is complete, OpsMx generates the overall results and they are displayed as shown below:
Repos Registered
Total Branches
Total Scans
Total Projects
Auto Scan Enabled Repos
Enable the Latest Scan toggle button to view only the most recent scans.
The panel at the bottom displays the project details. On expanding each project you can view the complete details of it.
Click View Reports to view the various reports related to the scan.
The current status of the scan (completed, pending or failed) is displayed to notify the status of the project.
The page displays the findings for each scan. Click on the appropriate tab to view the results.
On clicking the Download button, the scan results are downloaded in .json or .csv format.
On clicking Report, the scan results are downloaded in a report format.
On clicking Go to Artifact Page, you are redirected to the related artifact page.
Quick Actions
Each project displays 5 quick action buttons as shown:
Trigger Scan – Initiates a new scan for the project or runs a scan using a previously saved configuration.
Integrations – Opens the project's Integrations page, where all available integrations for the project are listed.
Policies – Displays the list of policies that have been configured for the project.
Edit Project – Opens the project configuration settings, allowing you to modify the project's details and scan settings.
Delete – Removes the project from the system.
Best Practices
To get the most out of OpsMx Delivery Shield Source Scan, consider following these best practices:
Frequent Scanning: Run the scans regularly (e.g., after each commit or weekly) to detect the vulnerabilities early.
CI/CD Pipeline Integration: Incorporate source scanning into your continuous integration/continuous deployment pipeline to identify the issues before they go live.
Alerts and Notifications: Set up alerts to notify your team when critical vulnerabilities are detected, to address them promptly.
Fixing Issues in Advance: Address vulnerabilities as soon as they are found to prevent issues from piling up.
Troubleshooting
If you encounter any issues during or after the scan, check the following:
Connection Issues with Bitbucket:
Ensure that the correct authentication methods (OAuth, API tokens, SSH) are set up properly.
Verify that the OpsMx account has the necessary permissions to access the Bitbucket repository.
Check for bitbucket url whitelisting in supplychain api configmap.
Last updated