View dependency component details
You can view details about a dependency components, including how it was matched. In the Software Bill of Materials (Products) page, select Actions ... > View details to view dependency component details.
Dependency detail modal fields
Field name | Description |
---|---|
Dependency name | This is what may be referred to as a component in other systems. It is the firmware, software, patches, or operating system that is installed on the physical representations of your device (e.g., Windows, OpenSSL). |
Dependency supplier | This is the organization that supplied the dependency component. The supplier may often be the manufacturer, but may also be a distributor or repackager (e.g., Microsoft for Windows). |
Dependency version | This is the version for this dependency name (e.g., 10.1 for Windows) |
CPE | This is the CPE we found in your SBOM (e.g., cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other) |
PURL | This is the PURL package we found in your SBOM (e.g., scheme:type/namespace/name@version?qualifiers#subpath) |
How is dependency matched?
Field name | Description |
---|---|
Supplier | This is the supplier name we matched on for this dependency (e.g., Microsoft for Windows) |
Name | This is what may be referred to as a component in other systems. It is the firmware, software, patches, or operating system that is installed on the physical representations of your device (e.g., Windows, OpenSSL). |
Version | This is the version we matched on for this dependency name (e.g., 10.1 for Windows) |
PURL repository | This is the PURL package we found in your SBOM (e.g., scheme:type/namespace/name@version?qualifiers#subpath) |
CPE | This is the CPE we found in your SBOM (e.g., cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other). CPE is considered the strongest match. |
Vulnerability source | This is the source where we found this dependency. The source is NVD if we found it in the NVD. If we did not find it in the NVD, it will show a NOT IN NVD token. |
Type | This is the type of match:
|
Matched on | This shows the sources that we used in making the match. See Match sources for more details. |
Matched by | This shows how the dependency was matched:
This shows whether our system made the match or whether a particular user on your account made the match. If it is a user, the user could have either created an alias for the match or could have selected a possible match we provided. |
Review details
Column name | Description |
---|---|
DETAILS | |
Dependency name | This is what may be referred to as a component in other systems. It is the firmware, software, patches, or operating system that is installed on the physical representations of your device (e.g., Windows, OpenSSL). |
Dependency supplier | This is the organization that supplied the dependency component. The supplier may often be the manufacturer, but may also be a distributor or repackager (e.g., Microsoft for Windows). |
Dependency version | This is the version for this dependency name (e.g., 10.1 for Windows) |
CPE | This is the CPE we found in your SBOM (e.g., cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other) |
PURL | This is the PURL package we found in your SBOM (e.g., scheme:type/namespace/name@version?qualifiers#subpath) |
HOW IS DEPENDENCY MATCHED? | |
Supplier | This is the supplier name we matched on for this dependency (e.g., Microsoft for Windows) |
Name | This is what may be referred to as a component in other systems. It is the firmware, software, patches, or operating system that is installed on the physical representations of your device (e.g., Windows, OpenSSL). |
Version | This is the version we matched on for this dependency name (e.g., 10.1 for Windows) |
PURL repository | This is the PURL package we found in your SBOM (e.g., scheme:type/namespace/name@version?qualifiers#subpath) |
CPE | This is the CPE we found in your SBOM (e.g., cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other). CPE is considered the strongest match. |
Vulnerability source | This is the source where we found this dependency. The source is NVD if we found it in the NVD. If we did not find it in the NVD, it will show a NOT IN NVD token. |
Type | This is the type of match:
|
Matched on | This shows the sources that we used in making the match. See Match sources for more details. |
Matched by | This shows how the dependency was matched:
This shows whether our system made the match or whether a particular user on your account made the match. If it is a user, the user could have either created an alias for the match or could have selected a possible match we provided. |
REVIEW DETAILS | |
Review status | This shows whether the dependency has been reviewed. |
Last reviewed on | This shows the last date the dependency was reviewed. |
Last reviewed by | This shows which user last reviewed this dependency. |
Last review note | This is the last review note that the last reviewer left on this dependency to help inform the team or progress, final status, or critical risk. |
Last updated