Create a Project by Importing an SBOM File

Overview

Mend.io enables you to import a previously generated SBOM file, to create a new project in the application.

An SBOM file traditionally specifies the libraries, code packages, and other third-party components that are used in your project.

Once imported, licensing and vulnerability data will be associated with your project’s dependencies, like any other project scanned into the application. Projects created via SBOM imports will be regularly monitored for new vulnerabilities and updates, like any other project in the application.

What’s Supported?

Mend.io allows you to import SBOM files exported by the following tools:

• Mend.io’s SBOM Export Report

• CycloneDX cdxgen

• Trivy

• Syft

• DependencyTrack

Supported Standards and Schema Requirements

The supported SBOM standards are CycloneDX (versions 1.4, 1.5, 1.6) and SPDX (versions 2.2, 2.3).
Note: For CycloneDX 1.6, only semantic support is available.
CBOM, CDXA, and AI/ML are not supported.

The supported formats are JSON and XML.

Read more about the schema requirements for SPDX and CycloneDX to ensure a smooth import, especially when creating and importing a self-generated SBOM.

CPE Support

When a package in your SBOM has no Package-URL (PURL), the importer will attempt to identify it using CPE (Common Platform Enumeration) as a fallback.

• PURL always takes precedence when present.

• For best coverage, Mend.io recommends ensuring your SBOM generation tool produces PURL identifiers. CPE is a useful fallback but PURL provides unambiguous package identification. Tools like Syft, Trivy, and Black Duck typically produce PURLs for most packages.

CPE Best Practices

Mend.io resolves packages from CPE by using the vendor field to determine the package ecosystem. A well-formed CPE looks like:

cpe:2.3:a:<vendor>:<product>:<version>:*:*:*:*:*:*:*

For best results, the vendor field should identify the organization or ecosystem that publishes the package — not the package name itself.

Multiple CPE entries

When a package has multiple CPE entries (common in Black Duck SBOMs), the importer will pick the first one with a recognized vendor. This means even if one CPE is ambiguous, a second CPE with a known vendor will work.

Java/Maven Special Handling

For Java packages, Mend includes a built-in lookup table that maps CPE vendor+product pairs to Maven coordinates (groupId and artifactId). This covers popular libraries from Apache, Spring, Eclipse, and many others. For example:

• cpe:2.3:a:pivotal_software:spring-boot:2.7.0:*:*:*:*:*:*:* resolves to org.springframework.boot:spring-boot

• cpe:2.3:a:apache:struts:2.5.30:*:*:*:*:*:*:* resolves to org.apache.struts:struts

Limitations

• Vendor = Package Name: The importer will not import a package when the vendor is just the package name repeated, e.g., cpe:2.3:a:bash:bash:5.2.15:*:*:*:*:*:*:*

• Vendor Ambiguity: The importer will not import a package when the vendor exists across multiple ecosystems, e.g., cpe:2.3:a:protobuf:protobuf:1.4.2:*:*:*:*:*:*:* (Go, Java, etc.)

• Native C/C++ Libraries: The importer will not import a package that isn't distributed through a supported package manager, e.g., pcsc-lite.

• Invalid CPE Strings: The importer will not import a package where file paths or other non-CPE values are specified in the CPE field.

Supported Vendors by Ecosystem

Prerequisites

• Only users with the Product Admin or Organization Admin role can access the product’s Configuration Page and upload a previously generated SBOM file.

Getting it done

Create a new Project by Uploading an SBOM File via the Add Project Wizard

To create a new project out of an existing SBOM file, you will need the relevant Product Admin (or an Organization Admin) to upload the SBOM file to the product in which you would like the new project created, via the Product Configuration Page. Here’s how to do it:

1. Navigate to the Products menu and select the product in which you would like to create the new project:

   

   
   

2. On the product page, click the “Add Project” button:

   

   
   

3. A. In the Project Details wizard, specify a Project Name and Description.
   B. Check the “Import SBOM” box, to reveal the option to upload an SBOM file.
   C. Click “Choose File” to browse your file system and select the desired SBOM file which meets the required specifications.

   

   
   

4. Click the “Create” button ( ) located at the bottom-right corner of the wizard.

At this stage, you may see a “Background process in progress” message at the top of the project page, indicating that the new project is being set up.

Compare your SBOMs

Mend.io recommends using the existing “Project Comparison” report to compare SBOMs.

Limitations

1. Source libraries in SBOM Export files generated by Mend.io are ignored.

2. No vulnerability/VEX data in the SBOM file gets imported. Vulnerability information in the newly created/updated project is based on the Mend.io database.

3. No licensing data in the SBOM file gets imported. Licensing information in the newly created/updated project is based on the Mend.io database.

4. Keywords support limitations:

   • For SPDX, Mend.io supports the properties below:

     "DEPENDS_ON", 
     "DYNAMIC_LINK", 
     "STATIC_LINK", 
     "CONTAINS", 
     "DESCRIBE"
     

   • For CycloneDX, Mend.io supports the “dependsOn” property.
     Example:

     "ref": "pkg:maven/com.google.apis/google-api-services-ml@v1-rev20210212-1.31.0?type=jar", 
     "dependsOn": [ "pkg:maven/com.google.api-client/google-api-client@1.31.1?type=jar" ]