Generate & upload SBOMs

Upload SBOMs to SBOM Observer to track your software supply chain, analyze vulnerabilities, and enforce security policies. You can generate SBOMs using any SCA tool or with Observer CLI.

Before You Start

You have access to SBOM Observer
Your SBOM is in CycloneDX or SPDX format

For CI/CD automation, also install Observer CLI.

Generate Your SBOM

Choose your preferred tool to generate an SBOM.

Generate with Observer CLI

Observer CLI auto-detects your project type and generates standardized CycloneDX SBOMs.

From source code:

observer fs -m sbom.cdx.json .

Scans the current directory and auto-detects:

Node.js (npm, yarn, pnpm)
Python (pip, poetry)
Java (Maven, Gradle)
Go, Rust, .NET, and more

From a container image:

observer image -o sbom.cdx.json myapp:latest

Scan images from Docker or pre-built images.

From a Kubernetes cluster:

observer k8s --sbom --upload

Creates a snapshot of your cluster and generates SBOMs for all running workloads. Requires kubectl access to your cluster.

See Observer CLI for more commands and options.

Generate with Third-Party Tools

You can generate SBOMs with any SCA tool that outputs CycloneDX or SPDX format:

Trivy - Container and filesystem scanning
Syft - Comprehensive multi-format SBOM generation
CycloneDX cdxgen - Creates SBOMs from build tools (npm, Maven, Gradle, etc.)
SPDX Tools - SPDX format generation and validation

Example with Syft:

syft . -o cyclonedx-json > sbom.cdx.json

Example with Trivy:

trivy fs --format cyclonedx . > sbom.cdx.json

Ensure your output is in CycloneDX JSON or SPDX JSON format before uploading to SBOM Observer.

Upload Your SBOM

Choose your preferred upload method.

Via Web Interface

Log in to SBOM Observer
Navigate to Attestations
Click Upload Attestation
Select your CycloneDX or SPDX JSON file and confirm the upload.

Your SBOM is now in SBOM Observer. It will be analyzed against all active policies and checked for vulnerabilities.

Via Observer CLI

First, get your API token:

Log in to SBOM Observer
Go to User Profile → Access Tokens
Create a token and copy it. You will not be able to see it again.

Then upload from the command line:

export OBSERVER_TOKEN=your-api-token
observer upload sbom.cdx.json --project my-app --environment production

Store your OBSERVER_TOKEN as a secret in your CI/CD platform. Never commit it to version control.

What Happens After Upload

Once uploaded, SBOM Observer:

Analyzes your SBOM against all active policies
Detects known vulnerabilities in your components
Tracks your supply chain over time
Alerts if new vulnerabilities are discovered

You'll see:

Policy violations - Components that don't meet your security standards
Vulnerabilities - CVEs and security issues
Component overview - Full inventory of your dependencies

Next Steps

Write policies to define what compliance means for your organization
Enforce policies in CI/CD to block non-compliant builds
Analyze impact to understand vulnerabilities and their implications
CI/CD Integration to automate SBOM generation and uploads

On this page