Create a Project using an SBOM Import

Overview

You can import a previously generated Dependencies SBOM or Container Image SBOM report, to create a new project out of it, that you can manage in the Mend Platform.

An SBOM report traditionally specifies the libraries, code packages, and other third-party components that are used in your project.

Getting it done

Note: If your SBOM file contains a synthetic library for unmatched source files, that library will not be imported, as it does not represent a real dependency in your inventory. This will lead to a different dependency count in the new project compared to the SBOM file and is expected behavior.

Upload an SBOM Report File via the Mend Platform UI

To import an SBOM report, you will need an Organization Admin to upload a previously generated SBOM report file to the Mend Platform via the Administration Page. Here’s how to do it:

Navigate to the “Manage Projects” screen:
Click the + Add Project button at the far right corner of the screen:

In the Add Project wizard, follow these steps:

Project Name - Specify a name for the new project that will be created out of the SBOM report.
Application - Specify the application that the new project will be a part of.
Import SBOM - Toggle this on to upload an SBOM file.
Dependencies / Containers - Specify the relevant engine.
Select or drag file here - You can browse your file system for the SBOM report file or drag-and-drop it. For Dependencies- XML/JSON. For Containers- JSON only.
Create - Click to start the upload.

Note that when the import completes, a new project will be created. You will be able to manage it like any other project in the Mend Platform.

Note:

Projects created from an SBOM import will carry a tag, to differentiate them from other projects, as follows:

- Key: SBOMImport; Value: true
For supported distributions, registries, and languages in Mend Container, refer to this excerpt.
Container import results are surfaced in the scan-details summary only.

Upload an SBOM Report File via API

Dependencies

Use this API to upload a single SBOM file to update an existing project.
Use this API to update an application, creating a new project.
Use this API to retrieve SBOM import logs.

Containers

POST /api/v3.0/projects/{projectUuid}/containers/importSbom — update existing Container project.
POST /api/v3.0/applications/{applicationUuid}/containers/projects/importSbom — create Container project under application.

Track and Troubleshoot your SBOM Import

While the import is taking place, you can track its progress via Administration → Projects → Scans → Details.

At the end of the import, the Details page will become exportable to .CSV.

This is useful for investigating warning/error messages, which often lead to partial/failed imports.

Example:

Additional information pertaining to the warnings will be available within the exported .CSV (available for Dependnecies import only).

Note: If no components are imported, an empty project will be created.

This will be denoted by the message “No components could be identified (0). The SBOM was imported with an empty component list; an empty project was created.”

Limitations

No vulnerability/VEX data in the SBOM file gets imported. Vulnerability information in the newly created/updated project is based on the Mend.io database.
No licensing data in the SBOM file gets imported. Licensing information in the newly created/updated project is based on the Mend.io database.

Keywords support limitations:

For SPDX, Mend.io supports the properties below:

"DEPENDS_ON", 
"DYNAMIC_LINK", 
"STATIC_LINK", 
"CONTAINS", 
"DESCRIBE"

For CycloneDX, Mend.io supports the “dependsOn” property.
Example:

"ref": "pkg:maven/com.google.apis/google-api-services-ml@v1-rev20210212-1.31.0?type=jar", 
"dependsOn": [ "pkg:maven/com.google.api-client/google-api-client@1.31.1?type=jar" ]