Syft

Anchore

Generates a software bill of materials (SBOM) from a source tree or container image.

Application & Supply Chain Free & Open Source CLI Not Started Cross-platform

Cyber Kill Chain & Defender Lifecycle

Attacker — Kill Chain
1 Reconnaissance
2 Weaponization
3 Delivery
4 Exploitation
5 Installation
6 Command & Control
7 Actions on Objectives
Defender — IR Lifecycle
8 Preparation
9 Detection & Analysis
10 Containment, Eradication & Recovery
11 Post-Incident Activity

Description

Syft produces an SBOM — the inventory of every package inside an artifact, in CycloneDX or SPDX format. On its own it finds no vulnerabilities; it answers the prior question, what is actually in here?

That question is the one that turns a newly published CVE from a week-long audit into a grep. It is also increasingly a contractual requirement rather than a nice-to-have.

Use cases

  • Producing a CycloneDX SBOM for a release artifact
  • Answering "are we affected?" the day a CVE lands
  • Feeding the inventory into Grype for vulnerability matching

Example

syft dir:. -o cyclonedx-json=sbom.json