Skip to content

SBOM Upload

BoostSecurity supports the direct upload of Cyclonedx SBOM files through the UI.

This enables users to generate and upload CycloneDX-format SBOMs for standalone analysis, which BoostSecurity then enriches with vulnerability insights, risk scores, and metadata, without requiring build pipeline integration. SBOMs uploaded via this method receive the same treatment as those generated from integrated projects which include:

  • Vulnerability enrichment (CVEs, EPSS, CVSS v3.1)
  • Malware detection
  • OpenSSF scorecard data
  • License insights
  • Dependency graph resolution (including transitive dependencies)

Once uploaded, the file is treated like any other inventory: enriched, monitored, and visualized through the SBOM interface.

How to upload CycloneDX SBOM files

To upload a CycloneDX SBOM file:

  1. Navigate to the SBOM page of the BoostSecurity dashboard.

  2. Click on the SBOM Upload button at the top right of the interface.

    SBOM Upload Button

  3. From the modal that appears, select the SBOM Type: Container Image or SCM Repository.

    Select SBOM Type

  4. Fill in required parameters and upload the file. Depending on your selected SBOM type, provide the required fields and select your CycloneDX file.

    • For Container Image uploads:

      1. Provider: Select the container registry service where your image is hosted. Supported providers include Docker Hub, AWS ECR, Google Container Registry, and others.
      2. Registry Name: Enter the domain or hostname of your container registry. For example, registry.hub.docker.com or 123456789.dkr.ecr.us-west-2.amazonaws.com.
      3. Repository Name: Specify the name of the repository within your registry that contains the container image. For instance, my-application/backend-service.
      4. Digest: Provide the SHA256 digest of the specific image version you intend to upload. This ensures the exact image is identified. An example digest would be sha256:abc123....
      5. Base URL (Optional): If you're operating in an on-premise environment or using a private registry, input the base URL of your registry here. This helps BoostSecurity locate and access your registry appropriately.
      6. Select File: Click this button to browse and select the CycloneDX SBOM file corresponding to your container image.

      Finally click the Upload button to finish the SBOM upload.

      Container Image SBOM Upload

    • For SCM Repository upload, fill out the required parameters:

      1. Monorepo: If your repository is a monorepo containing multiple projects or services, indicate this here. This helps in accurately associating the SBOM with the correct sub-project.
      2. Provider: Choose the source code management (SCM) platform hosting your repository, such as GitHub, GitLab, Bitbucket, etc.
      3. Repository Name: Enter the full path to your repository, typically in the format organization/repository-name.
      4. Default Branch: Specify the primary branch of your repository, commonly main or master. This identifies the branch from which the SBOM was generated.
      5. Commit ID: Provide the unique SHA hash of the commit corresponding to the SBOM. This ensures the SBOM is tied to a specific state of your codebase

      Finally click the Upload button to finish the SBOM upload.

      SCM Repository SBOM Upload

Once the upload is complete, the SBOM will be automatically analyzed, and vulnerabilities will be detected and enriched.