What is an SBOM?
A Software Bill of Materials (SBOM) is a machine-readable inventory of the software components running in an application. It lists third-party libraries, frameworks, and their known vulnerabilities, making it possible to quickly assess exposure when a new CVE is disclosed.
Shieldome generates SBOMs from scan findings: it detects software components from version disclosures, server headers, and dependency findings, then packages them in a standard format your tooling can consume.
Detection is passive. Components are extracted from what the scanner observes - server headers, CMS signatures, JavaScript library fingerprints, and similar signals. The SBOM is an approximation of externally visible components, not a full dependency graph (which would require source code access).
Supported formats
| Format | Standard | Output | Use case |
|---|---|---|---|
| CycloneDX | CycloneDX 1.4 | JSON (.cdx.json) |
OWASP-recommended format, widely supported by SCA tools and vulnerability scanners |
| SPDX | SPDX 2.3 | Tag-value text (.spdx) |
Linux Foundation standard, required by some regulated industries and government procurement |
What is included in the SBOM?
The SBOM generated by Shieldome contains:
- Metadata: scan date, tool name and version, target application URL
- Components: detected software packages with name, version, and Package URL (purl)
- Vulnerabilities (CycloneDX only): CVE IDs linked to specific components, with severity ratings
Detected component examples
| What we detect | How we detect it |
|---|---|
| nginx 1.24.0 | Server: nginx/1.24.0 response header |
| WordPress 6.4 | Generator meta tag or login page disclosure |
| jQuery 3.6.1 | Script tag src attribute with version in filename |
| PHP 8.1 | X-Powered-By: PHP/8.1 header |
| Django 4.2 | Debug error pages, WSGI server signature |
| OpenSSL 3.0 | TLS handshake server info |
Generating an SBOM
From the UI
- Open a completed scan in the History view
- Click the Export button (or the three-dot menu)
- Select Download SBOM (CycloneDX) or Download SBOM (SPDX)
- The file downloads immediately
Via API
# CycloneDX JSON (default)
curl -o sbom.cdx.json \
"https://app.shieldome.com/api/scan/SCAN_ID/sbom?format=cyclonedx" \
-H "Cookie: session=YOUR_SESSION" # or use API key auth
# SPDX tag-value
curl -o sbom.spdx \
"https://app.shieldome.com/api/scan/SCAN_ID/sbom?format=spdx" \
-H "Cookie: session=YOUR_SESSION"Using SBOMs in your pipeline
Once you have an SBOM, you can feed it into vulnerability management tools:
# Check the CycloneDX SBOM against the NVD with grype
grype sbom:sbom.cdx.json
# Import into Dependency-Track
curl -X POST https://dtrack.example.com/api/v1/bom \
-H "X-API-Key: $DTRACK_KEY" \
-F "autoCreate=true" \
-F "projectName=MyApp" \
-F "[email protected]"Compliance context
SBOM generation is required or recommended by several regulatory frameworks:
- US Executive Order 14028 (2021): mandates SBOMs for software sold to the US federal government
- EU Cyber Resilience Act: requires SBOMs for products with digital elements sold in the EU
- NIST SP 800-161: supply chain risk management guidance recommends SBOM practices
- PCI DSS 4.0 Req 6.3.2: maintain an inventory of bespoke and custom software