Skip to content

xBOM

xBOM is an umbrella term covering SBOM (software dependencies), CBOM (cryptographic assets), and AIBOM (AI/ML models). Each maps a different layer of the supply chain to track risk, meet compliance requirements like EO 14028 and the EU AI Act, and respond to vulnerabilities faster.

xBOM Architecture

Choose a Generation Method

knoxctl

knoxctl

Use the local knoxctl UI to scan filesystems, container images, and AI/ML models interactively and push results to your AccuKnox tenant.

Container Image Scan Action

Container Image Scan Action

Integrate AccuKnox's container scan GitHub Action into your CI/CD pipeline to scan images and generate SBOMs automatically on every push or pull request.

xBOM Scan Action

xBOM Scan Action

Use the AccuKnox xBOM Scan Action to generate SBOM, CBOM, and AIBOM from source code, container images, or AI/ML model sources directly in GitHub Actions.

Common Prerequisites

These setup steps are required regardless of which generation method you choose.

Step 0: Install knoxctl

Install knoxctl before starting xBOM generation.

Step 1: Create Project and Classifier

  1. Log in to the AccuKnox UI.

  2. Navigate to SBOM > Projects.

    Navigate to SBOM Projects

  3. Click Add Project.

    Click Add Project

  4. Fill in the following fields:

    • Project name
    • Description
    • Classifier

    Fill in project fields

  5. Click the Create button.

Note

The Project Name and Classifier must exactly match the values you pass in your workflow or knoxctl configuration.

Step 2: Create Labels

  1. In the AccuKnox UI, navigate to Settings.

    Navigate to Settings

  2. Go to Labels.

    Go to Labels

  3. Click the Label+ button.

    Click Label+ button

  4. Create the labels you need for organising your projects.

    Create labels

  5. Save your label configuration.

Reference: How to Create Labels

Step 3: Generate Access Key

  1. Navigate to Settings > User Management.

    Navigate to User Management

  2. Click on your user profile.

  3. Click the three-dot icon (⋮).

    Click the three-dot icon

  4. Select Create Access Key.

    Select Create Access Key

  5. Copy the access key and save it securely.

    Copy access key

Note

You will need this key for API authentication in the next steps.

Reference: How to Create Access Keys

Post-Generation Workflow

Once generated, BOMs automatically appear in your SBOM dashboard, where AccuKnox scans them for known CVEs, license issues, and outdated components. View vulnerability details, track remediation, and export reports under SBOM > Projects > [Your Project Name].