Import a software bill of materials and maintain components, versions and dependencies in the product workspace. Review vulnerability findings against the product configuration, then record the impact and the response.
CycloneDX import and exportJSON · XMLProduct versions and dependencies
The same library can support several product functions. Dependency relationships help reviewers identify those functions and decide what to inspect when a component changes.
Industrial gatewayv1.0.0
update-agent
example-update-agent
The update client receives firmware packages from the update service. This is the only component that changes version between the two example inventories.
Current example version
1.0.0
Referenced by
gateway
Review vulnerability findings
Explain the impact on the product
A vulnerability match gives the team a finding to investigate. The decision depends on the component actually delivered, its use in the product and the conditions an attacker would need.
Product vulnerability reviewMethod example / 01
Does the advisory refer to this component?
Compare the package identity, supplier, version and affected range. A similar name is a starting point for investigation, especially when suppliers have repackaged or modified the software.
Information to examine
Package identifiers, build records and the supplier's advisory.
Package identifierTo review
Affected version rangeTo review
Supplier advisoryTo review
Record the conclusion after reviewing this information. No vulnerability or test result is asserted for these fictional components.
Not at present. The component inventory imports CycloneDX JSON and XML. The SBOM format guide explains the differences between SPDX and CycloneDX.
Is a vulnerability match proof that the product is affected?
No. Check the component identity, version, affected code and operating conditions. Record the reasons for the impact decision so it can be reviewed when the product changes.
Can we try an example file?
Yes. The gateway example includes two downloadable CycloneDX inventories. Its fictional components illustrate the file structure and dependencies.
Start with your product architecture, software inventory and existing analysis, then develop the security records you need.
