Scanning SBOMs

Checkmarx only analyzes SBOM components that include a valid PURL. Components that lack a PURL field (for example, those identified only by a CPE or file hash) are skipped silently (i.e., they are not analyzed, but the scan proceeds normally and no error is logged).

For SPDX files, you must indicate which packages are direct dependencies. Declare a relationship of type DESCRIBES or DEPENDS_ON from the SPDXID of the SBOM's main component to each direct package. If no such relationships are defined, Checkmarx treats all packages in the file as direct dependencies.

Example relationship block (SPDX JSON):

{
  "spdxId": "SPDXRef-DOCUMENT",
  "relationshipType": "DESCRIBES",
  "relatedSpdxElement": "SPDXRef-Package-lodash"
}

{
  "spdxId": "SPDXRef-MyApp",
  "relationshipType": "DEPENDS_ON",
  "relatedSpdxElement": "SPDXRef-Package-requests"
}

SBOM scans can be run from the UI as well as via CLI or REST API.

cx scan create \
  --project-name "my-project" \
  --scan-types sca \
  --s /path/to/sbom.json

After the scan completes, results appear in the SCA Results view under the project.

What is included:

What is not included:

Fewer results than expected

Check whether your SBOM contains components with unsupported PURL types (rpm, generic, apk, docker, etc.). These are skipped silently.

Scan fails with an error about no valid PURLs

If Checkmarx cannot extract any valid PURLs from the SBOM, the scan terminates with an error rather than completing with zero results. This typically means the file contains no components with a supported PURL type, all PURLs are malformed, or the file does not follow a supported format. Open the SBOM file and confirm that at least one component has a valid purl field matching the format pkg:type/[namespace/]name@version with a type from the supported list.

npm scoped packages not found in results

Check that the @ sign in scoped package names is percent-encoded as %40 in the PURL. For example, @angular/core must appear as pkg:npm/%40angular/core@14.2.0, not pkg:npm/@angular/core@14.2.0.

Gradle / SBT / Ivy packages not found

These build tools are aliased to the Maven package manager. Ensure the PURL uses pkg:gradle/..., pkg:sbt/..., or pkg:ivy/... (or pkg:maven/...) and that the namespace follows Maven conventions: groupId/artifactId.