Generate SBoMs for Asset / Tools used

[preethamnagesh8]

Hi Steve,
I understand Cyclone DX generates SBoMs for software packages/librries/frameworks. Does it also generate an SBoM for applications/tools installed in a machine. Ex: in my laptop I have about 20 applications installed (Node JS, Visual Studio Code, Sublime Text ...). Can I generate an SBoM for such applications (found within Program Files) ?

[stevespringett]

CycloneDX is a specification only. There are build implementations that will generate CycloneDX BOMs from package managers. That said, CycloneDX can be used to describe any type of software (firmware, applications, docker containers, even hardware). For components that are not libraries, ensure that each component has a valid CPE.

Many orgs are using CycloneDX for asset vulnerabilities (operating systems and the apps that run on them) as well as for IoT and other types of embedded devices where there a mix of hardware, firmware, operating system, application, and libraries.

[preethamnagesh8]

Hi Steve,
Thanks for the info. I now understand that CycloneDX is just a specification format similar to JSON or XML. I have verified that some of the assets I use have valid CPEs. How do I generate BOM files in CycloneDX format. Is it possible that I run a command in program files folder in my machine, and it generates SBoM in cyclone DX format for all the assets in prog files ?

[stevespringett]

Again, CycloneDX is a specification. The specification is here:
https://github.com/CycloneDX/specification/blob/master/schema/bom-1.1.xsd

CycloneDX creates reference implementations for various build ecosystems (npm, maven, etc). Thats all.

The CycloneDX project itself doesn't provide any tooling. It is up to other projects or vendors who create tooling to support CycloneDX. There are vendors are adopting it. If you use an IT assessment management tool already, you may want to contact the vendor or project to inquire if they support CycloneDX or not. It's a relatively new spec, so chances are theres a lot of tools out there that do not yet support it. If a tool you like currently doesn't support it, create an enhancement request for that project for them to add support for CycloneDX.

[preethamnagesh8]

Thanks for the info Steve.