From JSON to Clarity: Practical Tools for SBOM Interpretation
summary
Five lightweight web apps convert raw CycloneDX/SPDX JSON into actionable views: a drag-and-drop HTML tool that flags duplicate bomRefs, generic PURLs and absent CPEs; a dependency graph that surfaces direct vs transitive links; a CVE age tracker that reports counts (example: 7 of 50 CVEs >6 months) and prioritizes long‑standing issues; a license classifier that groups GPL/Apache/unknown; and a version‑drift checker that detects archived GitHub repos and end‑of‑life releases. All tools export CSV, run in the browser, and are on GitHub for reuse.
AI-written summary · about
chapters (10)
- 0:00SBOM interpretation challenges
- 1:32SBOMs underleveraged
- 3:20AI for practical SBOM tools
- 6:31SBOM quality analyzer
- 14:18SBOM dependency analyzer
- 18:37CVE age tracker
- 22:29License analysis
- 24:57Version drift analysis
- 27:27Acting on SBOM insights
- 29:55Q&A
related talks
21mKnow Your JS: SBOMs for Frontend Devs
40mSBOM Ingestion and Analysis at New York-Presbyterian Hospital
47mThe Missing Link - How we collect and leverage SBOMs
47mI Can’t Cope! How OWASP Is Helping To Manage Vulnerability Overload
26mFlagship Projects: CycloneDX
29mThe Current State of SBOMs for End Users
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
18mThe Current State of Open Source Security Compliance Tooling Is … Well, Sad.