Export your SBOM

You can use this export function, or you can take advantage of our enhanced SBOM and vulnerability reports, as well as the only FDA expert-crafted SBOM that ensures you meet FDA SBOM requirements!

There are two ways to export your SBOM:

• Click the Reports item in the sidebar, then click the corresponding export button on the report card.

• Click the Manage SBOM drop-down button, then click Export SBOM.

When downloading (exporting) your SBOM to share with others or for auditing purposes, you can either export your original SBOM or your enhanced SBOM (with matches our system made automatically or that your team matched). You can also choose to include vulnerabilities and any associated CPE or PURL information in your export. SBOMs are currently exported in CycloneDX 1.4 format. If you are interested in exporting in another format, let us know.

Customize your SBOM export

• Export as file name: This is the filename that will be generated with your exported data.

• Export details: You can choose to export your original SBOM or your enriched SBOM. Your enriched SBOM can include vulnerabilities, enriched CPE and PURL information, and more.

• Export as file type: For your original SBOM, you can export in CycloneDX JSON, SPDX JSON or XML, and CSV. For your enriched SBOM, you can export in CycloneDX or SPDX JSON.

• Include vulnerabilities: Check this box to export all of the vulnerabilities associated with this SBOM. This will include the source name (currently always the NVD), a link to the vulnerability, both its v2 and v3 CVSS scores and vector strings, when the vulnerability was first detected, when it was updated, and more.

• Include enriched CPEs and PURLs from matching: Your original SBOM export will include all CPE/PURL information, but you can check this box to export all enriched CPE/PURL data, including those identified by Helm or during the matching and analysis process or that you manually matched or added.

SBOM contains component hashes

If your SBOM contained any component hashes when uploaded, that information was retained and will be exported intact to any SBOM report.

Export lifecycle and license data

You can export lifecycle data, including level of support and EOS/EOL infomration, as well as license data for your components to your FDA SBOM or SBOM CSV report. You can also export lifecycle data to your CycloneDX SBOM.

Export lifecycle data to CycloneDX SBOM

You can import from and export lifecycle data, including level of support and EOS/EOL information, to your CycloneDX SBOM. Refer to Including lifecycle information for more info.

Export Windows KB patch data to CycloneDX SBOM

You can import from and export Windows KB patch data to your CycloneDX SBOM. Refer to Including Windows KB patch information for more info.

You can export lifecycle and license data for your components as an FDA SBOM or export the SBOM CSV report.

CycloneDX SBOM

You can export Level of support and/or EOS/EOL to a CycloneDX SBOM provided that you use the following properties. This information will be populated into the respective columns in the Products table, as well as in the component details.

• Level of support (date): Import will support cdx:lifecycle:milestone:endOfSupport property or eos_date (Medcrypt-specific property). Export will be the CycloneDX native property.

• EOS/EOL (date): Import will support cdx:lifecycle:milestone:endOfLife property or eol_date (Medcrypt-specific property). Export will be the CycloneDX native property.

• Level of support (text): Import will support medcrypt:lifecycle:milestone:endOfLifeText or eol_text. Export will be `medcrypt:lifecycle:milestone:endOfLifeText.

• EOS/EOL (text): Import will support medcrypt:lifecycle:milestone:levelOfSupportText or eos_text. Export will be `medcrypt:lifecycle:milestone:levelOfSupportText.

Refer to the official CycloneDX property taxonomy in GitHub for definitions.