Upload your first SBOM

Ready to upload your first SBOM, or not sure what an SBOM is? We’re here to help! Helm supports both CycloneDX and SPDX SBOM formats, making it easy for you to manage your software components.

Upload a CycloneDX or SPDX SBOM

Click Add SBOM > Upload SBOM.
If you are uploading a compressed SPDX SBOM file, follow these steps.

Supported SBOM versions and formats

Versions:

CycloneDX: 1.3 (import only), 1.4 (import and export), 1.5 (import only)
SPDX: 2.2, 2.3

Formats:

CycloneDX: .json, .xml
Single SPDX files: .spdx, .json, .yaml, .xml
Compressed SPDX files: .gz, .tgz, .zip, .zst, .tzst

File size: 50MB

Where did my Add SBOM button go?

If you've already uploaded an SBOM, this button changes to Manage SBOM, providing you with additional actions. You can also check your SBOM file upload status from here.

In the modal that displays, specify a product name and version.
Click the Choose file button to browse to your SBOM file.
Click Upload SBOM.
Need to include EOS/EOL information? You can import your CycloneDX SBOM with EOS/EOL information included in these properties.
Need to include Windows KB patch information? You can import your CycloneDX SBOM with WinKBs included in this property.
If you're not seeing your SBOM components loading, check that you have Auto-refresh turned on, or manually refresh the page. Larger SBOMs will take a bit more time. If you're still not seeing your SBOM, click Manage SBOMs > View file upload status. If you see a Failed status here, click the icon next to that status for more information. If you can't resolve the issue, contact us for help.
Once you’ve uploaded your SBOM, you will see all of the components that are contained in that product display on the page. We’re already starting to match, drawing data from the NVD, including Package URLs (PURL) of Cargo, NPM, Nuget, or Pypi package manager), CPE strings, component name/version/supplier combo, and alias matches.
If you need to aggregate and merge additional SBOMs to this SBOM, click Manage SBOMs > Upload SBOM. This will add components from that SBOM to your existing SBOM.
If you see any warning or error icons next to your component version, click the icon for more information. You should be able to just edit the version for a warning scenario, but will need to contact us for an error scenario. You'll need to resolve this issue before we can match this component and return any vulnerabilities.

Not ready to add your SBOM yet? No worries!

You can create each of your products and their respective versions, then add your SBOM at any time.

In the Select product drop-down, select the Create product option, specify the product name, then Save. You’ll now see your new product selected. You’ll now need to add a version to upload an SBOM to.
In the Select version drop-down, select the Create version option, specify the version, then Save. Click the Add SBOM drop-down button, then select the Upload SBOM option.

Upload a compressed SPDX file

If you have a compressed SPDX SBOM file, follow these steps to upload it:

Prepare your files:
- Create a directory named after what you want to name your zip file.
- Navigate into that directory and create a subdirectory named packages in this directory.
- Copy your individual SBOM files into the packages directory.
Compress your files:
- Use the following commands to compress your files into a .tar.gz or .zip format:
  - Create .tar.gz: COPYFILE_DISABLE=1 tar -zcvf yourfilename.tar.gz yourdirectory
  - Create .zip: zip -r yourfilename.zip yourdirectory -x '**/.*'
Upload your file:
- Once compressed, go to Helm and upload your .tar.gz or .zip compressed file following the upload process above.

To include lifecycle information, these are the supported properties you can use in your CycloneDX SBOM. This information will be populated into the respective columns in the Products table, as well as in the component details. Note that if your SBOM contains duplicate properties for the same component, Helm will take the first property and discard the rest. For each field, you can only include either date or text value - if you include both, only date will be populated in the Helm UI.

Including lifecycle information?

To use any of these properties, you will need to include the whole namespace value (e.g., cdx:lifecyle:milestone.endOfSupport or medcrypt:lifecycle:milestone:endOfLifeText) in the name field and the corresponding value in the value of the property. We will import and export from thecomponent and/or metadata > components array of your CycloneDX SBOM.

Level of support (date): Import will support cdx:lifecycle:milestone:endOfSupport name property or eos_date (Medcrypt-specific name property). Export will be the CycloneDX native property.
EOS/EOL (date): Import will support cdx:lifecycle:milestone:endOfLife name property or eol_date (Medcrypt-specific name property). Export will be the CycloneDX native property.
Level of support (text): Import will support medcrypt:lifecycle:milestone:endOfLifeText or eol_text name property. Export will be `medcrypt:lifecycle:milestone:endOfLifeText.
EOS/EOL (text): Import will support medcrypt:lifecycle:milestone:levelOfSupportText or eos_text name property. Export will be `medcrypt:lifecycle:milestone:levelOfSupportText.

End of support example with component array

...
"component" : {
    "name" : "[PRODUCT_NAME]",
    "version" : "2.2.3".
    "type" : "application",
    "bom-ref" : "dd8fc70b-767a-4398-885c-bbd0e8f6c68",
    "properties" : [
        {
            "name" : "cdx:lifecycle:milestone:endOfSupport",
            "value" : "2026-02-07T22:00:0Z"
        },
        {{
            "name" : "medcrypt:lifecycle:milestone:levelOfSupportText",
            "value" : "Q1 2026"
        }
 ...

Check the CycloneDX GitHub repo for more information on their native properties.

End of support example with component array

...
"component" : {
    "name" : "[PRODUCT_NAME]",
    "version" : "2.2.3".
    "type" : "application",
    "bom-ref" : "dd8fc70b-767a-4398-885c-bbd0e8f6c68",
    "properties" : [
        {
            "name" : "cdx:lifecycle:milestone:endOfSupport",
            "value" : "2026-02-07T22:00:0Z"
        },
        {{
            "name" : "medcrypt:lifecycle:milestone:levelOfSupportText",
            "value" : "Q1 2026"
        }
 ...

Check the CycloneDX GitHub repo for more information on their native properties.

Including Windows KB patch information?

CycloneDX does not support Windows KB information natively, so to include Windows KB patch information, this is the Medcrypt-specific property you can use in your CycloneDX SBOM.

To use this property, you will need to include the whole namespace value (e.g., medcrypt:vulnerability:remediation:mskb in the name field and the corresponding value in the value of the property. of the component or metadata > components array of your CycloneDX SBOM. We will import and export from thecomponent and/or metadata > components array of your CycloneDX SBOM.

Import and export will support the medcrypt:vulnerability:remediation:mskb name property, but regardless of where the KBs appeared in the original SBOM, they will be exported to metadata > component only.

Windows KB example with component array

...
"component" : {
    "name" : "[PRODUCT_NAME]",
    "version" : "2.2.3".
    "type" : "application",
    "bom-ref" : "dd8fc70b-767a-4398-885c-bbd0e8f6c68",
    "properties" : [
        {
            "name" : "medcrypt:vulnerability:remediation:mskb",
            "value" : "KB12849"
        },
        {{
            "name" : "medcrypt:vulnerability:remediation:mskb",
            "value" : "KB994849"
        }
 ...

Including lifecycle information?

To include lifecycle information, these are the supported properties. This information will be populated into the respective columns in the Products table, as well as in the component details. Note that if your SBOM contains duplicate properties for the same component, Helm will take the first property and discard the rest. For each field, you can only include either date or text value - if you include both, only one will be uploaded.

Level of support (date): Import will support cdx:lifecycle:milestone:endOfSupport property or eos_date (Medcrypt-specific property). Export will be the CycloneDX native property.
EOS/EOL (date): Import will support cdx:lifecycle:milestone:endOfLife property or eol_date (Medcrypt-specific property). Export will be the CycloneDX native property.
Level of support (text): Import will support medcrypt:lifecycle:milestone:endOfLifeText or eol_text. Export will be `medcrypt:lifecycle:milestone:endOfLifeText.
EOS/EOL (text): Import will support medcrypt:lifecycle:milestone:levelOfSupportText or eos_text. Export will be `medcrypt:lifecycle:milestone:levelOfSupportText.

What happens after upload?

Once you’ve uploaded your SBOM, Helm will automatically start matching your components with known software in the NVD (National Vulnerability Database). This leverages several match sources, such as Package URLs (PURLs), CPE strings, component names, and alias matches. Refer to Match statutes and Resolve match statuses for more information.

Check out Match sources for more information on sources we consult, and Match statuses to understand how we determine match statuses and suggest possible matches.

Create products and versions without an SBOM

In the Select product drop-down, choose Create product, specify the product name, then click Save.
In the Select version drop-down, choose Create version, specify the version, and click Save.
When you have an SBOM ready, just click the Add SBOM drop-down button (Manage SBOM if you already have uploaded other SBOMs), then select Upload SBOM when you’re ready to add your SBOM file.

Troubleshooting and support

You may have turned off auto-refresh. You can either turn it back on from the Auto-refresh switch above the table, or you can click Refresh to manually refresh the page.

Not seeing your SBOM components?

You may have turned off auto-refresh. You can either turn it back on from the Auto-refresh switch above the table, or you can click Refresh to manually refresh the page. If you're still not seeing your SBOM, check the status of your SBOM file upload via the Manage SBOMs drop-down button > View file upload status. In the status modal, click the icon next to the Failed status to get more information. If you need help, contact us.

No exact match

If Helm can’t find an exact match in the NVD, refer to Resolve match statuses for further instructions.

Upload issues

Have a large SBOM file?

If you have a larger SBOM file, this could take a little longer to upload. Get a cup of coffee or tea while we process your SBOM! We'll automatically start matching to known software in the NVD as soon as your upload is completed successfully.

Don't think your SBOM uploaded successfully?

If you're still not seeing your SBOM, check the status of your SBOM file upload via the Manage SBOMs drop-down button > View file upload status. In the status modal, click the icon next to the Failed status to get more information. If you need help, contact us.

SBOM contains component hashes

Although you can't currently view masked component hashes in Helm, rest assured that the component hash information in your SBOM has been retained and will be exported intact to any SBOM report.

Need help getting started?

Have a different SBOM format

If you have another format (e.g., Word, CSV), contact us so we can convert it for you. We’re in the process of adding more complete support for all of the data in your CycloneDX format of SBOM, as well as adding support for the SPDX SBOM format.

Don’t worry – we’ve got you covered! We can provide expert assessment, guidance, and design of anything from building cybersecurity and continuous improvement into your product development lifecycle to your Public Key Infrastructure cryptography to FDA letters and most anything in between.

Need to generate an SBOM

We've worked with a lot of open-source tools ourselves and have also provided any other tools we know of for generating a CycloneDX SBOM or a SPDX SBOM.

Don't know what an SBOM is or not sure where to start

Take our FDA readiness assessment survey to start down your path to a smooth FDA submission process!

PreviousGet expert Services help NextUpload or convert .zst SBOM files from Yocto on Linux

Last updated 13 days ago

Was this helpful?