<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-software-bill-of-materials
description: >-
  Analyze Software Bills of Materials for completeness, accuracy, and security
  posture. Correlate SBOM components against vulnerability databases, verify
  NTIA minimum elements, and track dependency drift across releases.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - sbom
  - cyclonedx
  - spdx
  - vulnerability-correlation
  - dependency-analysis
  - ntia
  - software-transparency
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Analyzing Software Bill of Materials

## Overview

SBOM analysis goes beyond generation — it involves validating completeness against
NTIA minimum elements, correlating components with CVE databases, identifying phantom
dependencies missing from the inventory, and tracking component drift between releases.
This skill covers deep SBOM inspection for supply chain risk assessment and regulatory
compliance (EO 14028, EU CRA).

Mode: `[MODE: BLUE]` — Supply chain visibility through SBOM analysis.

## Prerequisites

| Requirement | Details |
|---|---|
| Syft for SBOM generation (`curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh`) | Required |
| Grype for vulnerability correlation (`curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh`) | Required |
| CycloneDX CLI (`npm install -g @cyclonedx/cyclonedx-cli`) | Required |
| jq for JSON processing | Required |
| Python 3.10+ with `packageurl-python` | Required |

## Key Concepts

### NTIA Minimum Element Validation

```bash
# Check CycloneDX SBOM for NTIA minimum elements
jq '{
  has_supplier: (.components | map(select(.supplier != null)) | length),
  has_version: (.components | map(select(.version != null)) | length),
  has_purl: (.components | map(select(.purl != null)) | length),
  total_components: (.components | length),
  has_timestamp: (.metadata.timestamp != null),
  has_author: (.metadata.authors != null or .metadata.manufacture != null)
}' sbom.cdx.json

# Identify components missing required fields
jq '.components[] | select(.purl == null or .version == null) | {name, version, purl}' sbom.cdx.json
```

### Dependency Drift Detection

```bash
# Compare two SBOM versions for added/removed/changed components
diff <(jq -r '.components[] | "\(.name)@\(.version)"' sbom-v1.json | sort) \
     <(jq -r '.components[] | "\(.name)@\(.version)"' sbom-v2.json | sort)

# Extract only new dependencies between releases
comm -13 \
  <(jq -r '.components[].name' sbom-v1.json | sort -u) \
  <(jq -r '.components[].name' sbom-v2.json | sort -u)
```

### Vulnerability Correlation

```bash
# Scan SBOM with Grype and extract critical findings
grype sbom:sbom.cdx.json -o json | jq '.matches[] | select(.vulnerability.severity == "Critical") | {
  package: .artifact.name,
  version: .artifact.version,
  cve: .vulnerability.id,
  fixed_in: .vulnerability.fix.versions[0]
}'

# Cross-reference with OSV database
osv-scanner --sbom=sbom.cdx.json --format json | jq '.results[].packages[]'
```

### Component Risk Scoring

```bash
# Count transitive vs direct dependencies
jq '{
  direct: [.components[] | select(.scope == "required")] | length,
  optional: [.components[] | select(.scope == "optional")] | length,
  total: (.components | length)
}' sbom.cdx.json

# List components by ecosystem
jq '[.components[] | .purl // "no-purl"] | group_by(split(":")[0]) |
  map({ecosystem: .[0] | split(":")[0], count: length})' sbom.cdx.json
```

## Workflow

### Step 1: Analyze SBOM Completeness

```bash
node scripts/agent.js --action analyze --sbom /tmp/sbom.cdx.json --output /tmp/analysis.json
```

### Step 2: Correlate Vulnerabilities

```bash
node scripts/agent.js --action correlate --sbom /tmp/sbom.cdx.json --output /tmp/vuln-report.json
```

### Step 3: Compare SBOM Versions

```bash
node scripts/agent.js --action diff --sbom /tmp/sbom-v1.json --baseline /tmp/sbom-v2.json --output /tmp/drift.json
```

## Detection

```yaml
title: Software Bill Of Materials Detection
id: aac9997e-413a-4123-bca4-2c60cfff3f0c
status: experimental
description: Detects suspicious activity related to analyzing software bill of materials techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*analyzing*software*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Software Bill Of Materials Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] All SBOM components have PURL identifiers
- [ ] NTIA minimum elements present (supplier, version, timestamp, author)
- [ ] Vulnerability correlation returns zero critical unpatched CVEs
- [ ] Dependency drift tracked between consecutive releases
- [ ] Phantom dependencies identified and added to SBOM
- [ ] Component license information populated for compliance

## References

- [NTIA SBOM Minimum Elements](https://www.ntia.gov/page/software-bill-materials)
- [CycloneDX Specification](https://cyclonedx.org/specification/overview/)
- [SPDX Specification](https://spdx.github.io/spdx-spec/)
- [Grype Documentation](https://github.com/anchore/grype)
- [OSV Database](https://osv.dev/)
