Skip to main content
Skip table of contents

SBOM Report for Container Images

Note: This feature is supported from Mend CLI version 24.5.3 (released on June 2024).

Overview

As a security and/or compliance officer, you may want to generate an SBOM report for your container images directly from the Mend Platform, to quickly assess the components and their associated metadata within each container in the project/application.

Supported Versions and File Types

Standard

Supported Versions

File Types

SPDX

  • 2.2

  • 2.3

  • json

  • xml

  • tv

CycloneDX

  • 1.4

  • 1.5

  • json

  • xml

Getting it done

Generate your Container Image SBOM from the Mend CLI

The --format CLI flag

Use the --format flag to specify the desired SBOM standard and file type:

CODE
mend image <Image:Tag> --format <sbomType-filetype>

SBOM format options:

Value <sbomType-filetype>

Output File format

spdx-json

json

spdx-tv

tv

spdx-xml

xml

cyclonedx-xml

xml

cyclonedx-json

json

Export the results to a file using the --filename flag, in addition to the --format flag

Simple BOM output in the Mend CLI

Get a flat BOM view directly from the Mend CLI, by using the --show=bom option:

CODE
mend image <image> --show=bom

Output:

Name: Package Name

Version: Package version

Type: Package type (for OS packages - the package manager type)

Example image:

image-20240613-083301.png

Generate your Container Image SBOM from the Mend Platform UI

  1. Navigate to the Reports page

  2. Create +Create to open the report creation wizard

    image-20240616-055845.png

In the report creation wizard:

  1. Select Container Image SBOM

  2. Specify the Application and Project(s)

    image-20241017-100147.png
  3. Specify the desired SBOM Standard (SPDX 2.2 / SPDX 2.3 / CycloneDX 1.4 / CycloneDX 1.5).

    image-20241017-100443.png
  4. Specify the desired file format

  5. Click ‘Create’

    image-20241017-100808.png

When the report is ready, download it by selecting the ‘Download’ option from the Actions menu, as depicted below.

Download

At this stage, the report will be added to the list of reports in the main Reports page, allowing you to download it by clicking the More Options button (vertical ellipsis) at the right edge of the screen and then ‘Download’:

image-20240313-114207.png
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.