Upload an SBOM

You can manually upload a supported SBOM from an Aura product.

Each successful SBOM upload creates a new release for the product.

Before you begin

You need:

access to an Aura workspace;
an existing product;
a valid CycloneDX SBOM in JSON or XML format.

If you do not have a product yet, see First steps in Aura.

Upload an SBOM

Sign in to Aura.
Open the appropriate workspace.
Select Products from the navigation.
Open the product that the SBOM belongs to.
Select Upload SBOM.
Choose or drag a CycloneDX JSON or XML file into the upload dialog.
Select Upload SBOM.

Aura begins processing the file.

What happens after upload?

After a successful upload:

Aura creates a new release for the product.
The SBOM is processed.
Release-level inventory and analysis are prepared.
When processing is complete, the release status changes to READY.

You can then review the release and related views.

Depending on your workspace and plan, these can include:

components;
dependency relationships;
vulnerability findings;
license information;
policy results;
security posture information.

Every upload creates a release

Every successful SBOM upload creates a new release.

This also applies when you upload another SBOM for the same software version.

This allows Aura to preserve release-specific inventory and security information over time.

Manual upload or automated ingestion?

Manual upload is useful when:

you are getting started with Aura;
you are testing an SBOM;
you need to add an individual SBOM manually.

For recurring engineering workflows, use the SBOM Ingestion area for automated ingestion through supported API or CI/CD workflows.

See:

If the upload fails

If Aura rejects the file or cannot process it, check:

that the SBOM is CycloneDX;
that it is valid JSON or XML;
that the document is complete;
that its CycloneDX specification version is supported;
that the file was generated correctly.

See Troubleshoot an SBOM.