From e04cef0202f7880dbc4fb3aac9ffa5d230b22696 Mon Sep 17 00:00:00 2001 From: Jino Tesauro Date: Fri, 14 Aug 2026 15:34:38 -0500 Subject: [PATCH] docs(sbom): document the Asset-page export and the version it produces MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Exporting SBOMs and VEX page covered only the token-auth API endpoints. The Asset page's own Export panel — SBOM, VEX and SBOM with vulnerabilities (VDR) — was undocumented, so the three choices and what each one produces were discoverable only by using them. Adds a section describing the three export types and notes that each choice now names the format and specification version it produces. Also states that the Asset page and the API emit the same specification version, so a document from either path is interchangeable with the other. --- .../locations/PRO__exporting_sboms_and_vex.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/content/asset_modelling/locations/PRO__exporting_sboms_and_vex.md b/docs/content/asset_modelling/locations/PRO__exporting_sboms_and_vex.md index 7a1c3bd632..2d6202757e 100644 --- a/docs/content/asset_modelling/locations/PRO__exporting_sboms_and_vex.md +++ b/docs/content/asset_modelling/locations/PRO__exporting_sboms_and_vex.md @@ -9,6 +9,20 @@ DefectDojo Pro can serialize an Asset's current dependency inventory back out as Both endpoints require **V3 Locations** to be enabled, and respect Asset-level permissions: an Asset the requesting user cannot view returns a 404. +## Exporting from the Asset page + +The Asset page carries an **Export** panel offering the same data without going through the API, in one of three shapes: + +| Export type | What the document contains | +| --- | --- | +| **SBOM** | The component inventory only. | +| **VEX** | The vulnerability analysis only — a standalone document describing the exploitability of this Asset's findings. | +| **SBOM with vulnerabilities (VDR)** | Both — the inventory with an embedded `vulnerabilities` block carrying the VEX analysis. | + +Each choice names the format and specification version it produces, for example *SBOM — component inventory only (CycloneDX 1.6)*. Those labels are read from the server as the panel renders rather than written into the page, so they describe the document you will actually receive: when the exporters adopt a newer specification, the labels follow rather than going stale. + +The Asset page and the API endpoints below emit the same specification version, so a document exported from either path is interchangeable with the other. + ## Exporting an SBOM ```