SBOM ingest
also: SBOM import, SBOM parsing
SBOM ingest is the process of importing and parsing a Software Bill of Materials (SBOM) document into a system for vulnerability scanning, compliance tracking, or dependency analysis.
SBOM ingest refers to consuming and processing an SBOM file—typically in formats like SPDX, CycloneDX, or SWID—into a vulnerability management or supply chain security tool. The ingestion process parses the structured metadata describing all software components, dependencies, and licenses in an application or container image.
When you ingest an SBOM, the system catalogs each dependency and version, then cross-references it against known vulnerability databases (like NVD or CVE feeds) to identify security risks. For example, you might generate an SBOM from a Docker container with syft, then ingest it into Grype or a commercial scanner to detect vulnerable packages before deployment.
SBOM ingestion is essential in modern supply chain security, especially for compliance frameworks like NIST and for container security pipelines. Many CI/CD tools now support automated SBOM generation and ingestion to catch dependency vulnerabilities early in the development lifecycle.