Viewing Software Bill of Materials(SBOM)
A Software Bill of Materials (SBOM) is a detailed inventory that includes all the third-party and open-source software components used in the product. FortiDevSec SBOM references page presents a complete list of all the software components used in your product and helps you easily track these components, their versions, and any security vulnerabilities they may have.
Perform the following steps to view SBOM.
-
In the FortiDevSec Dashboard > Applications, click See details in the desired application which contains secret scan to view scan details.
-
In scanned application details page, click SBOM.
-
SBOM References window is displayed. The components are grouped based on their ecosystem and the following fields are displayed for each component.
Field Description Dependency The name of the third party library being used. Version The version of the library being utilized. License Displays license information for the dependency. Licenses with known risks are highlighted. Vulnerable Notifies whether the library is vulnerable or non-vulnerable. Source File The file path where the library name and version are mentioned and utilized. 
-
Click Export and choose CSV to save the list of all components in a Microsoft Excel file. Alternatively, select Cyclone DX to export the list in the Cyclone DX JSON format.
Viewing Dependency Chain Graph
The Dependency chain graph window offers a comprehensive view of your software component's dependency relationships. Analyze both direct and transitive dependencies to identify potential issues.
Perform the following steps to view dependency chain graph.
-
In the FortiDevSecDashboard > Applications, click the desired application name or the number of vulnerabilities which contains secret scan to view scan details.
-
Click SBOM in the SCA scanner widget. SBOM References window is displayed.
-
Select the software component and click Dependency graph.
-
The following information is displayed in Dependency chain graph window.
Field Description Package Name
Package name of the selected software component.
Dependency type Type of dependency, transitive or direct. If the selected software component contains both direct and transitive dependency then transitive will be displayed as dependency type.
A direct dependency is a component that you directly reference in your code.
A transitive dependency is a component that your selected component indirectly relies on through its direct dependencies.
Introduced through Provides information about the path through which a package was introduced. Import path Dependency chain graph for the selected package from the Introduced through section.
