Skip to main content

SBOM

Gain visibility into your container images and the software packages they include. The SBOM integration scans images for software components and known vulnerabilities, enabling you to query, monitor, and alert on changes in your software supply chain.

Installation​

For this integration, you will need access to your container registry and a list of container images that you want to scan for SBOM (Software Bill of Materials) ingestion. If your registry is private, you will also need to provide authentication credentials.

Configuration in JupiterOne​

To install the SBOM integration in JupiterOne, navigate to the Integrations tab and select SBOM. Click New Instance to begin configuring your integration.

Creating a configuration requires the following:

  • The Registry URL, such as ghcr.io or ghcr.io/jupiterone, which specifies the location of your container images.
  • A list of Images to scan. Each image should be provided in the format <image>:<tag>. If no tag is provided, the integration will default to using the latest tag.

If your container registry is private, you must also provide the following credentials:

  • Registry Username – The username for accessing the container registry.
  • Registry Password – The corresponding password. This field is encrypted and stored securely.

Click Create once all required values are provided to finalize the integration.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.