Anchore SBOM

Anchore SBOM supports uploading SBOMs in the following versions:

CycloneDX
• JSON: Versions 1.2 – 1.6
• XML: Versions 1.0 – 1.6

SPDX
• JSON: Versions 2.2 – 2.3
• Tag-Value: Versions 2.1 – 2.3

Anchore supports exploring unified SBOMs in the following formats:
• CycloneDX v1.6
• SPDX v2.3

Anchore Enterprise generates SBOMs for containers as part of CI/CD, registry, or runtime scanning. This allows it to generate additional data about Dockerfile content, image content, and other metadata. This extra information can be used for additional scans for malware or secrets, or compliance checks as part of the Anchore Enforce module. SBOMs uploaded to the system for non-Anchore tools are scanned for vulnerability information only. SBOMs uploaded to the system for non-Anchore tools are scanned for package, license, and vulnerability information.

Anchore allows you to upload SBOMs generated by non-Anchore tools representing both codebases under your control (internal SBOMs) as well as third-party SBOMs provided to your organization by partners, contractors, and upstream suppliers. These SBOMs represent assets not available for Anchore scanning and allow unification of security information between artifacts scanned by Anchore and those represented by uploaded SBOMs.

SBOMs are imported as Assets for a given Application Version. Compliance issues, packages, and vulnerabilities are normalized and deduplicated across all assets for a given Application Version.

The Anchore Score is a computed composite security index that provides a numeric value for each vulnerability in the system. It is derived from a combination of the CVSS score, vulnerability severity, EPSS percentile, and KEV status, but can also factor in additional data. Currently, the CVSS score & vulnerability severity, EPSS percentile, and KEV status are equally weighted. The Anchore Score represents the relative importance of a given vulnerability within a particular set of vulnerabilities defined by an Application Version context. This ordering helps users focus on the most critical issues for expedient security analysis and remediation planning.

Anchore SBOM is included in all Anchore Enterprise subscriptions.