Exporting Your SBOM
Export Overview
SBOM Workbench provides export capabilities from both the Detected and Identified tabs, each serving different purposes in your software audit and compliance workflow.Difference Between Exporting an SBOM File and Exporting a Project
These are two distinct operations and it is important to understand the difference: Exporting an SBOM file generates a standards-compliant bill of materials document (e.g. CycloneDX, SPDX Lite, or CSV) containing your component inventory, licence information and vulnerability data. This is the output you share with stakeholders, submit for compliance, or feed into downstream tools. It reflects only the component data, not your audit workspace. Exporting a project saves a complete snapshot of your entire audit workspace. This includes all scan results, identification decisions, notes, annotations, component statuses and the full audit history. Use this when you need to archive your work, share it with a colleague for continued review, or resume auditing on another machine.
Exporting from Detected
Exports from the Detected tab provide raw, unreviewed scan data directly from the analysis engine.
Available Formats (Detected)
- Raw
- WFP (Winnowing FingerPrint)
-
CSV
- SBOM
- Cryptography
- Vulnerabilities
-
BOM Formats
- CycloneDX
- CycloneDX with Vulnerabilities
- SPDX Lite
- HTML Summary
Exporting from Identified
Exports from the Identified tab include only components and vulnerabilities that have been manually reviewed and confirmed.
Available Formats (Identified)
- CSV
- SBOM
- Cryptography
- Vulnerabilities
-
BOM Formats
- CycloneDX
- CycloneDX with Vulnerabilities
- SPDX Lite
- HTML Summary
-
Settings (
scanoss.json)