Software Bill of Materials (SBOM)
Delivery Shield automates SBOM generation into existing workflows with dedicated support for technical issues and queries.
Navigate to Setup → Integrations in Delivery Shield.
Connect your container registry, CI/CD pipeline, and source repositories.
Enable Syft / CDXGEN integration.
Set the polling interval and target services for automated SBOM generation.
View generated SBOMs from the SBOM section of the Artifact Security page.
Export SBOMs on demand in CycloneDX, SPDX, or JSON format.
Viewing SBOM Results in Delivery Shield
SBOM data is accessible from multiple locations within the platform:
SBOM Page — org-wide SBOM view showing all components, versions, licenses, and CVE status per service
View Reports Page (Source Scan) — downloadable SBOM report including the Vulnerability column per component
Artifact Pages — a View SBOM button is available on all artifact pages, enabling a comprehensive SBOM view of all artifacts.
Application Status Page — displays the security status, active vulnerabilities, and alerts of running services derived from SBOM analysis.
License data is visible in the downloaded SBOM file. Ensure you download the report to access full license information per component.
The SBOM pages for all the artifacts (Deployed / Generated / Plugin/ Mobile) can be accessed from the corresponding Artifact Security page.
To Access SBOM for the Application
The SBOM for the applications is available to view in the Artifact Security page.
Navigate to Artifact Security and click on the required artifacts page.
Click View SBOM.
The SBOM page is displayed.
You can click Download, to download the complete details of the page.
You can click Licenses, to download all the licenses available for the selected application.
You can click Report, to download this page in a report format.
The page displays the different components and their details as follows:
Component - Displays the component name.
Version - Displays the version of the displayed component.
Package URL - Displays the package URL of the component.
License - Displays all the available licenses.
Vulnerabilities - Displays the count of the vulnerabilities for the given component.
EOL Risk - Displays the EOL status of the component OSS package based on he score which user can add baseline version for a OSS project.
Dependency - Displays the dependency of the components.
Actions - You can add or remove licenses by clicking the Edit License button.
On clicking the Edit License option, the license details page is displayed. You can do the necessary changes and update the details.
To Access SBOM for Individual Artifacts
The SBOM for the individual artifacts is available to view in the Artifact Security page.
Navigate to Artifact Security and click on the required artifacts page.
Click the view icon in the SBOM column, next to the required artifact.
The SBOM page is displayed.
Click Download, to download the complete details of the page.
Click Licenses, to download all the licenses available for the selected application.
Click Report, to download this page in a report format (PDF or html).
Click VEX Report to download the details in json or csv file format.
The programming language associated with the scanned components is displayed, providing better visibility into application composition.
The page displays the different components of the artifact and their details as follows:
Component - Displays the component name.
Version - Displays the version of the displayed component.
Package URL - Displays the package URL of the component.
License - Displays all the available licenses.
Vulnerabilities - Displays the count of the vulnerabilities for the given component.
EOL Risk - Displays the EOL status of the component OSS package based on he score which user can add baseline version for a OSS project.
Dependency - Displays the dependency of the components.
Actions - You can add or remove licenses by clicking the Edit License button.
On clicking the Edit License option, the license details page is displayed. You can do the necessary changes and update the details.
SBOM Levels
The Complete SBOM, Top Level, N Level, Delivery and Transitive view of SBOM can be accessed from this page.
On clicking each panel the details of the corresponding level are displayed.
Top Level - Provides a general summary of the software elements that are either integrated or directly used in a product. Essential details like component names, versions, and their interactions within the software are usually included.
N Level - Goes beyond top-level overview to include deeper details and complexities. The "N" in "N-level" represents any arbitrary level of depth, indicating that the SBOM includes information at multiple tiers or levels of granularity.
Delivery - Describes every part, library, and dependency that is part of a software release or delivery package. It offers clarity regarding the makeup of the software that is being supplied.
Transitive - Includes not only the direct dependencies of a software component but also its indirect or transitive dependencies.
On expanding the components, it provides a drill-down view that displays its dependencies of dependencies along with the corresponding vulnerability details.
For N Level you can choose (between 1 to 5) up to how many levels of dependencies you want to be listed.
SBOM Comparison
The SBOMs can be compared to identify differences in components, versions, licenses, and vulnerabilities.
Click the Compare icon in the SBOM column, next to the required artifact.
The SBOM comparison page is displayed. Select the two SBOMs that you wish to compare from the dropdown and click Compare.
The complete details of comparison are displayed as shown below:
Last updated