Know what software is running, and what is known to be wrong with it.

Software component visibility across your systems, correlated with known vulnerabilities, in support of supply chain risk management and federal SBOM requirements.

Component inventory, correlated

AlloyGRC inventories the software installed across your systems and correlates it with known vulnerabilities, so a package can be traced from where it runs to what is known to be wrong with it.

How it works

How the SBOM pipeline builds the inventory

The stages that turn what is installed into a correlated component and vulnerability view.

STAGE 01

Data Ingestion

Software installation information is retrieved from the configured connector of choice and reshaped

Collection with software to hardware assets mapping

STAGE 02

CPE generation

Software names and versions are ingested to produce their Common Platform Enumeration (CPE), mapping software details like version, vendor and name in a universally recognized template.

Universally identifiable software identification and nomenclature

STAGE 03

SBOM Generation

A dedicated docker uses the previously generated CPEs to scout product sources for information like components and known vulnerabilities to generate a brief summary along with component and vulnerability breakdowns

Uniformly structured SBOM documents by software

Placeholder stage description, edit in sbom-pipeline.json.

One record

What a single component looks like once its correlated

Every component carries the same field set. Where nothing is known, the field says so rather than guessing. The record below is illustrative: the fields are real, the values are not.

pkg:github/nodejs/[email protected] RECORD

software Nodejs

version 20.40.1

vendor nodejs

devices desktop-a1bcde2

cpe cpe:2.3:a:nodejs:nodejs:20.40.1:*:*:*:*:*:*:*

total vuln count 1

critical vuln count 0

high vuln count 0

moderate vuln count 0

low vuln count 0

sbom summary Node.js version 20.40.1 is installed in the server identified as desktop-a1bcde2. One high risk-vulnerability was identified. CVE-2000-12345, affecting the Rollup component, with a CVSS score of 9.8, allows attackers to execute arbitrary code. To resolve the risk, update the component to version 2.50.1. This remediation is urgent and must be completed within 30 days for federal compliance.

License MIT

Illustrative record. Field set is real, values are invented.

Fields on every record

software

Name of the installed software
version

Corresponding version number.
vendor

Name of the associated vendor.
devices

DNS names associated with the devices on which the software is installed.
cpe

Normalized product CPE per CycloneDX format
total vuln count

Total count of all vulnerabilities affecting the system.
critical vuln count

Number of associated vulnerabilities ranked Critical.
high vuln count

Number of associated vulnerabilities ranked High.
moderate vuln count

Number of associated vulnerabilities ranked Moderate.
low vuln count

Number of associated vulnerabilities ranked Low.
sbom summary

Complete actionable summary including component vulnerability details and risk level.
license

Associated software licenses

What you can do

Check whether a given package is present anywhere in your environment
Trace a vulnerable component to the systems that carry it

Risk Management

Also in this area

Rank, schedule and close what matters

How it all fits together

Software Composition and SBOM Pipeline has more to show than fits on this page yet. A full walkthrough with visuals is being written. Ask for a demo to see it running today.

See your software the way your assessor will.

Ask for a demo and we will walk through component visibility on synthetic data.

Request a Demo Vulnerability views built on it