CycloneDX and SPDX SBOMs and lockfiles

What the connector does

Import a CycloneDX SBOM (JSON or XML), an SPDX 2.x JSON file or a dependency manifest: TechWatchAlert recognizes each component by its CPE, purl or name, and lets you choose what goes into the stack. A new version of the file replaces the previous one, removals included.

What comes into TechWatchAlert

• Components and versions from CycloneDX and SPDX 2.x (JSON) SBOMs
• Manifests and lockfiles: package.json, package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, Pipfile.lock, poetry.lock, go.mod, composer.json, composer.lock, pom.xml, Gemfile.lock, Cargo.lock
• Components sorted into monitorable (already cited by a CVE) and unreferenced, before you confirm
• CVEs already published for new components, caught up in your alerts
• A CycloneDX file carrying vulnerabilities (VEX/VDR) is imported as a scan report

Setup

1. Open Connectors › SBOM and manifest files, then “Import a file” (5 MB and 5,000 components max)
2. Review the component selection, application name and alert threshold, then confirm
3. For an SBOM kept up to date by CI, upload it via the API with a key holding the “SBOM upload” permission