Software Bill Of Materials (SBOM)¶
To access the SBOM service, select SBOM from the application's sidebar in the BoostSecurity dashboard. From the main SBOM view, the list of projects and their detected vulnerabilities and the account-wide view are provided.
Account Summary¶
The first section of the SBOM view is the account summary. The overall number of vulnerabilities per level is provided, i.e., the overall number of vulnerabilities across all projects and third-party components in the account. The SBOM document can be downloaded in either Cyclonedx, Spdx or CSV format for the account, from the account summary. The account summary SBOM documents contain the inventory of all components across all projects in the account.
Projects Specific Summary¶
The projects summary section provides a project-based posture, providing a summary of the number of vulnerabilities:
- Per severity level
- Per project for all projects in the account
The project-specific SBOM document can be downloaded in either the Cylonedx or Spdx format for any project from that section.
The projects are presented in descending order of vulnerability severities.
Info
The search area can be used to search for a project by name keyword across all projects in the account.
Packages¶
The Packages view provides a quick way to find all packages and third-party components included across all projects in the account.
The packages are presented in decreasing order of number and severity of vulnerabilities. For each package, the following are provided:
- The number and severity of vulnerabilities.
- The number of repositories in the account, including the package.
Note
The search area can be used to search for a package by name or vulnerability id.
Package Details¶
Select a package from the list of packages to view further details. These details include:
- Name
- Type
- Version
- Repositories
- Vulnerailities
- Ecosystem
- OpenSSF Score
Vulnerabilities¶
The vulnerability details for each package can be viewed by selecting the Vulnerabilities tab. The list of vulnerabilities is presented, including the
- Vulnerability ID
- Severity
- Advisories
- Source
- Description
- CVSS v3.1 Score
- EPSS Score
CVSS 3.1 and EPSS Score¶
The CVSS and EPSS scores can be viewed by clicking on a vulnerability listed in the Vulnerabilities tab.
The vulnerabilities details view can be exited with "Esc" or by clicking the close (x) button.
Repositories¶
Select the Repositories tab to view the list of repositories.
The project link can be selected from the list of projects, taking the user to the project-specific view.
No Packages Found¶
If results are not found based on selected filters, you will be notified that no vulnerable packages meet the criteria.
Transitive Dependencies¶
Transitive dependencies occur when security vulnerabilities or issues are detected not directly within the project's code but within the dependencies of a project's codebase, forming a chain of interconnected components.
BoostSecurity analyzes dependencies and their associated vulnerabilities comprehensively. It not only identifies issues within the project's direct dependencies but also uncovers vulnerabilities within transitive dependencies. By flagging these transitive dependencies, BoostSecurity provides an avenue for developers to prioritize and address security issues, thereby ensuring the integrity of applications.
Patch recommendations¶
For each library vulnerability, we display a link to the library's vulnerability details page. This page contains a list of all the library versions affected by the vulnerability. If a patch is available, it will specify the library version containing the fix.
Data Update Cycle¶
Data sources are regularly refreshed to ensure the most up-to-date information is available for analysis and decision-making. Updates occur every 12 hours, maintaining the accuracy and relevance of the data provided to users.