<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-supply-chain-sbom-enrichment
description: >-
  Enrich Software Bills of Materials with vulnerability data, license
  intelligence, maintainer metadata, project health scores, and end-of-life
  status to transform raw SBOMs into actionable risk intelligence.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - sbom-enrichment
  - vulnerability-enrichment
  - license-intelligence
  - project-health
  - risk-intelligence
  - dependency-metadata
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Implementing Supply Chain SBOM Enrichment

## Overview

Raw SBOMs provide component inventories but lack the context needed for risk
decisions. SBOM enrichment adds vulnerability correlation, license analysis,
maintainer reputation, project activity metrics, and end-of-life status to each
component. This transforms a static inventory into dynamic risk intelligence
that drives prioritized remediation and informed dependency decisions.

Mode: `[MODE: BLUE]` — Enrich SBOMs with actionable security and risk intelligence.

## Prerequisites

| Requirement | Details |
|---|---|
| Grype for vulnerability correlation | Required |
| OSV-Scanner for advisory lookup | Required |
| deps.dev API access (public) | Required |
| jq for JSON processing | Required |
| Python 3.10+ with `requests`, `packageurl-python` | Required |

## Key Concepts

### Vulnerability Enrichment

```bash
# Enrich SBOM components with vulnerability data
grype sbom:sbom.cdx.json -o json | jq '{
  enriched: [.matches[] | {
    package: .artifact.name,
    version: .artifact.version,
    cve: .vulnerability.id,
    severity: .vulnerability.severity,
    cvss: .vulnerability.cvss[0].metrics.baseScore,
    fixed_in: .vulnerability.fix.versions[0],
    url: .vulnerability.urls[0]
  }]
}'

# Cross-reference with EPSS scores
curl -s "https://api.first.org/data/v1/epss?cve=CVE-2024-1234" | jq '.data[0]'
```

### Project Health Scoring

```bash
# Query deps.dev for project metadata
curl -s "https://api.deps.dev/v3alpha/systems/npm/packages/express/versions/4.18.2" | jq '{
  publishedAt: .publishedAt,
  isDefault: .isDefault,
  licenses: .licenses
}'

# Check OpenSSF Scorecard
curl -s "https://api.securityscorecards.dev/projects/github.com/expressjs/express" | jq '{
  score: .score,
  checks: [.checks[] | {name, score}]
}'

# Query libraries.io for maintenance status
curl -s "https://libraries.io/api/npm/express?api_key=KEY" | jq '{
  latest_release: .latest_release_published_at,
  stars: .stars,
  forks: .forks,
  rank: .rank
}'
```

### License Intelligence

```bash
# Extract and classify licenses from SBOM
jq '.components[] | {
  name,
  version,
  license: (.licenses[0].license.id // .licenses[0].expression // "UNKNOWN"),
  type: (if (.licenses[0].license.id // "") | test("MIT|Apache|BSD|ISC") then "permissive"
    elif (.licenses[0].license.id // "") | test("GPL|AGPL|LGPL") then "copyleft"
    else "unknown" end)
}' sbom.cdx.json
```

## Workflow

### Step 1: Enrich SBOM with vulnerability and metadata

```bash
node scripts/agent.js --action enrich --sbom /tmp/target --output /tmp/enrich-result.json
```

### Step 2: Calculate risk scores for SBOM components

```bash
node scripts/agent.js --action score --sbom /tmp/target --output /tmp/score-result.json
```

### Step 3: Generate enriched SBOM risk report

```bash
node scripts/agent.js --action report --sbom /tmp/target --output /tmp/report-result.json
```

## Detection

```yaml
title: Supply Chain Sbom Enrichment Detection
id: 4a41d341-b872-4b5e-89fb-96f043c92ce3
status: experimental
description: Detects suspicious activity related to implementing supply chain sbom enrichment techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*implementing*supply*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Supply Chain Sbom Enrichment Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] All components enriched with vulnerability status
- [ ] License classification applied to every component
- [ ] Project health scores calculated for critical dependencies
- [ ] End-of-life dependencies flagged for replacement
- [ ] EPSS scores correlated for vulnerability prioritization

## References

- [deps.dev API](https://deps.dev/)
- [OpenSSF Scorecard](https://securityscorecards.dev/)
- [EPSS Model](https://www.first.org/epss/)
- [libraries.io API](https://libraries.io/api)
