SBOM Mapper

apps/frontend/src/components/global/upload_tabs/FileReader.vue

@@ -33,6 +33,7 @@
                   <li>AWS Security Finding Format (ASFF)</li>
                   <li>Burp Suite</li>
                   <li>Checklist</li>
+                  <li>CycloneDX Software Bill of Materials (SBOM)</li>
                   <li>DBProtect</li>
                   <li>Fortify</li>
                   <li>Golang Security Checker (gosec)</li>

apps/frontend/src/store/report_intake.ts

@@ -11,6 +11,7 @@ import {
   BurpSuiteMapper,
   ChecklistResults,
   ConveyorResults as ConveyorResultsMapper,
+  CycloneDXSBOMResults,
   DBProtectMapper,
   fingerprint,
   FortifyMapper,
@@ -275,6 +276,8 @@ export class InspecIntake extends VuexModule {
         return new ChecklistResults(convertOptions.data).toHdf();
       case INPUT_TYPES.GOSEC:
         return new GosecMapper(convertOptions.data).toHdf();
+      case INPUT_TYPES.CYCLONEDX_SBOM:
+        return new CycloneDXSBOMResults(convertOptions.data).toHdf();
       case INPUT_TYPES.TRUFFLEHOG:
         return new TrufflehogResults(convertOptions.data).toHdf();
       default:

libs/hdf-converters/README.md

@@ -5,32 +5,34 @@
 OHDF Converters supplies several methods to convert various types of security tool data to and from the OHDF standard. OHDF Converters can be used in a variety of tools, and is currently well integrated with Heimdall itself, and the [SAF CLI](https://github.com/mitre/saf).
 
 ## Supported Formats
+
 1.  [**asff-mapper**] - AWS Security Finding Format JSON file, Prowler-derived AWS Security Finding Format results from concatenated JSON blobs, and Trivy-derived AWS Security Finding Format results from concatenated JSON blobs
 2.  [**aws-config-mapper**] - AWS Config
 3.  [**burpsuite-mapper**] - BurpSuite Pro XML file
 4.  [**caat-mapper**] - Compliance Assessment and Audit Tracking (CAAT) file
 5.  [**checklist-mapper**] - Checlist Mapper format
 6.  [**conveyor-mapper**] - Conveyor JSON file
-7.  [**dbprotect-mapper**] - DBProtect report in "Check Results Details" XML format
-8.  [**fortify-mapper**] - Fortify results FVDL file
-9.  [**gosec-mapper**] - gosec results JSON file
-10. [**ionchannel-mapper**] - SBOM data from Ion Channel
-11. [**jfrog-xray-mapper**] - JFrog Xray results JSON file
-12. [**msft-secure-mapper**] - Microsoft Secure Score results file
-13. [**nessus-mapper**] - Nessus XML results file
-14. [**netsparker-mapper**] - Netsparker XML results file
-15. [**nikto-mapper**] - Nikto results JSON file
-16. [**prisma-mapper**] - Prisma Cloud Scan Report CSV file
-17. [**sarif-mapper**] - SARIF JSON file
-18. [**scoutsuite-mapper**] - ScoutSuite results from a Javascript object
-19. [**snyk-mapper**] - Snyk results JSON file
-20. [**sonarqube-mapper**] - SonarQube vulnerabilities for the specified project name and optional branch or pull/merge request ID name from an API
-21. [**splunk-mapper**] - Splunk instance
-22. [**trufflehog-mapper**] - Trufflehog results json file 
-23. [**twistlock-mapper**] - Twistlock CLI output file
-24. [**veracode-mapper**] - Veracode Scan Results XML file
-25. [**xccdf-results-mapper**] - SCAP client XCCDF-Results XML report
-26. [**zap-mapper**] - OWASP ZAP results JSON
+7.  [**cyclonedx-sbom-mapper**] - CycloneDX SBOM JSON file
+8.  [**dbprotect-mapper**] - DBProtect report in "Check Results Details" XML format
+9.  [**fortify-mapper**] - Fortify results FVDL file
+10. [**gosec-mapper**] - gosec results JSON file
+11. [**ionchannel-mapper**] - SBOM data from Ion Channel
+12. [**jfrog-xray-mapper**] - JFrog Xray results JSON file
+13. [**msft-secure-mapper**] - Microsoft Secure Score results file
+14. [**nessus-mapper**] - Nessus XML results file
+15. [**netsparker-mapper**] - Netsparker XML results file
+16. [**nikto-mapper**] - Nikto results JSON file
+17. [**prisma-mapper**] - Prisma Cloud Scan Report CSV file
+18. [**sarif-mapper**] - SARIF JSON file
+19. [**scoutsuite-mapper**] - ScoutSuite results from a Javascript object
+20. [**snyk-mapper**] - Snyk results JSON file
+21. [**sonarqube-mapper**] - SonarQube vulnerabilities for the specified project name and optional branch or pull/merge request ID name from an API
+22. [**splunk-mapper**] - Splunk instance
+23. [**trufflehog-mapper**] - Trufflehog results json file
+24. [**twistlock-mapper**] - Twistlock CLI output file
+25. [**veracode-mapper**] - Veracode Scan Results XML file
+26. [**xccdf-results-mapper**] - SCAP client XCCDF-Results XML report
+27. [**zap-mapper**] - OWASP ZAP results JSON
 
 ### NOTICE
 
@@ -48,4 +50,4 @@ This software was produced for the U. S. Government under Contract Number HHSM-5
 
 No other use other than that granted to the U. S. Government, or to those acting on behalf of the U. S. Government under that Clause is authorized without the express written permission of The MITRE Corporation.
 
-For further information, please contact The MITRE Corporation, Contracts Management Office, 7515 Colshire Drive, McLean, VA  22102-7539, (703) 983-6000.
+For further information, please contact The MITRE Corporation, Contracts Management Office, 7515 Colshire Drive, McLean, VA 22102-7539, (703) 983-6000.

libs/hdf-converters/index.ts

@@ -30,6 +30,7 @@ export * from './src/netsparker-mapper';
 export * from './src/nikto-mapper';
 export * from './src/prisma-mapper';
 export * from './src/sarif-mapper';
+export * from './src/cyclonedx-sbom-mapper';
 export * from './src/scoutsuite-mapper';
 export * from './src/snyk-mapper';
 export * from './src/sonarqube-mapper';

libs/hdf-converters/package.json

@@ -26,6 +26,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-config-service": "^3.95.0",
+    "@cyclonedx/cyclonedx-library": "^6.11.0",
     "@e965/xlsx": "^0.20.0",
     "@mdi/js": "^7.0.96",
     "@microsoft/microsoft-graph-types": "^2.40.0",