Find & Review SBOMs

The Find & Review feature in Portal allows you to discover, search, and analyze SBOMs from your suppliers, partners, and the broader community.

Overview

Find & Review helps you:

• Discover supplier SBOMs
• Search by product, component, or vulnerability
• Review SBOM quality and completeness
• Compare product versions
• Make informed procurement decisions

Searching for SBOMs

Basic Search

1. Navigate to Portal → Find SBOMs
2. Enter search terms in the search bar
3. Press Enter or click Search

Search Fields

Advanced Search

Click Advanced for more options:

Search Syntax

Use operators for precise searches:

# Exact phrase
"apache tomcat"

# Component search
component:log4j

# Supplier search  
supplier:"Acme Corp"

# Version range
version:>=2.0.0

# Exclude term
database -mysql

# Combine filters
supplier:"Acme" AND component:spring

Search Results

Results List

Search results display:

Sorting Options

Sort results by:

• Relevance (default)
• Product name
• Supplier name
• Update date
• Component count

Filtering Results

Narrow results using filters:

• Category - Product category
• Supplier - Specific vendors
• Access - Public / My SBOMs / Shared with me
• Compliance - Compliance status

Reviewing SBOMs

SBOM Overview

Click a result to view details:

Detailed Analysis

View in-depth SBOM analysis:

Components Tab

• Full component list
• Version information
• Package URLs (PURLs)
• Supplier data

Vulnerabilities Tab

• CVE list with severity
• CVSS scores
• Fix availability
• Exploitation status

Licenses Tab

• License types
• Compatibility analysis
• Attribution requirements

Quality Tab

• SBOM completeness score
• Missing fields
• Data quality issues

Comparing SBOMs

Version Comparison

Compare different versions of the same product:

1. Open product SBOM
2. Click Compare Versions
3. Select versions to compare
4. View differences

Comparison View

Product Comparison

Compare different products:

1. Select multiple products
2. Click Compare Products
3. View side-by-side analysis

Requesting Access

Request Private SBOMs

For SBOMs not publicly available:

1. Find the product
2. Click Request Access
3. Provide justification
4. Submit request

Request Status

Track request status:

Adding to My SBOMs

Save for Later

Add SBOMs to your collection:

1. Find SBOM
2. Click Add to My SBOMs
3. Select destination folder
4. Confirm

Organizing Saved SBOMs

Create folders to organize:

1. Go to My SBOMs
2. Click + New Folder
3. Name the folder
4. Drag SBOMs to organize

Subscribing to Updates

Enable Notifications

Subscribe to SBOM updates:

1. Open product SBOM
2. Click Subscribe
3. Choose notification preferences:
   • New versions
   • Vulnerability updates
   • Compliance changes

Managing Subscriptions

View and manage subscriptions:

1. Go to Settings → Subscriptions
2. View all subscriptions
3. Modify or cancel as needed

Exporting SBOMs

Download Options

Download SBOMs in various formats:

Bulk Export

Export multiple SBOMs:

1. Select SBOMs
2. Click Export Selected
3. Choose format
4. Download archive

Integration with TPRM

Link discovered SBOMs to vendor assessments:

1. Find vendor SBOM
2. Click Link to TPRM
3. Select or create vendor profile
4. Associate SBOM

See Third Party Risk Manager for more.

API Access

# Search SBOMs
curl -X GET "https://api.safeguard.sh/v1/portal/search?q=apache" \
  -H "Authorization: Bearer $API_KEY"

# Get SBOM details
curl -X GET https://api.safeguard.sh/v1/portal/sboms/{id} \
  -H "Authorization: Bearer $API_KEY"

# Request access
curl -X POST https://api.safeguard.sh/v1/portal/sboms/{id}/request-access \
  -H "Authorization: Bearer $API_KEY" \
  -d '{"justification": "Vendor evaluation"}'

Best Practices

Searching

• Use specific terms for precise results
• Combine filters for targeted searches
• Save common searches
• Subscribe to important suppliers

Reviewing

• Check compliance status first
• Review vulnerability summary
• Verify component completeness
• Compare with previous versions

Organization

• Create logical folder structure
• Tag important SBOMs
• Review subscriptions regularly
• Archive outdated SBOMs

Next Steps

• My Products
• SBOM Repository
• Third Party Risk Manager