Threat Detective detects the format and spec version automatically from the file's content. You never have to tell it what you're uploading.
Import formats
CycloneDX JSON: any document declaring
"bomFormat": "CycloneDX". This is the most common output from tools like syft, cyclonedx-cli and Dependency-Track.SPDX 2.2 and 2.3: JSON documents, translated automatically on import. Tag-value documents are also understood; for web upload the file needs a
.jsonextension, so tag-value SBOMs are best sent through the CI/API upload.SPDX 3.0.0 and 3.0.1: JSON-LD documents, as produced by newer Yocto releases.
CSV: a flat component list using the CycloneDX CLI column format, for teams without an SBOM toolchain. See Add components manually or by CSV.
Uploads are limited to 50 MB and 50,000 components per SBOM.
What each format gives you
JSON SBOMs carry the software item name and version number in their own metadata, so Threat Detective creates everything from the file. They also carry dependency relationships. CSV imports create a flat component list without dependency relationships, and ask you for the version number at upload.
Export formats
From the project's Reports tab you can export each version as:
CycloneDX JSON: written as CycloneDX 1.6, the version that downstream SBOM tools (grype, trivy, Dependency-Track) reliably consume.
SPDX JSON
CycloneDX VEX and OpenVEX: your triage decisions in machine-readable form. See Export VEX documents.
Not sure what your build produces?
Most SBOM generators (syft, cyclonedx-npm, Yocto, Zephyr's build system) will emit at least one of the formats above. If an upload is rejected with a format error, see Troubleshoot a failed or incomplete import. And if your tool produces something we don't accept, tell us via the messenger: format coverage is driven by what customers' toolchains actually emit.