Skip to main content

Import your first SBOM

Upload a CycloneDX, SPDX or CSV file and follow the import through parsing, validation and the vulnerability scan to your first findings.

Written by Alan Parkinson

An SBOM upload is the fastest way to get real findings in front of you. Threat Detective creates the software item and version from the file's own metadata, so there's no manual setup needed first.

Upload the file

  1. Open your project and go to the SBOMs tab.

  2. Click Upload SBOM.

  3. Drop your file or browse to select it. Supported formats: CycloneDX JSON, SPDX JSON, or CSV, up to 50 MB. The format and spec version are detected automatically.

  4. Click Upload SBOM to start the import.

You'll see "File uploaded. We're importing your SBOM now." and land on a progress page that updates automatically.

What the import does

Every import runs through five stages:

  1. Upload SBOM

  2. Parse & import components

  3. Inherit metadata from previous version: curated data from an earlier version of the same software item carries forward.

  4. Validate against FDA rules

  5. Scan for vulnerabilities: components are matched against the major vulnerability databases (GitHub Security Advisories, the US National Vulnerability Database and OSV.dev).

Large SBOMs can take a few minutes, and the vulnerability scan is usually the slowest step. You can leave the page: the import continues in the background, and the Imports page in your project keeps the history.

When it completes

The success panel shows how many components were imported, plus any Import notes (warnings worth a glance, such as rows that were skipped). Click View SBOM to open the new version.

Then take the panel's advice: open the version and click Run enrichment to pull in missing licence, end-of-support and supplier data from external sources. See Run enrichment and watch progress for what that adds.

Your first findings

Matched vulnerabilities appear in two places: on the version's workbench under Triage vulnerabilities, with a severity breakdown from Critical to Low, and on the project's Vulnerabilities tab, with one row per advisory matched to your software. Critical and high severity findings need a decision before a version can be released.

If the import fails instead, see Troubleshoot a failed or incomplete import.

Did this answer your question?