License Statistics SBOM policy

As of License Statistics v6.24, X-Formation provides a Software Bill of Materials (SBOM) policy, using the CycloneDX specification. License Statistics delivers two separate sbom.json files for License Statistics and License Statistics Agent in each of their main installation directories. 

The SBOM policy lists all License Statistics libraries and their dependencies for all software components, including license type and version. This information helps you to determine any library vulnerabilities. 

LM-X License Manager SBOM and VEX policy

Starting with LM-X License Manager v6.0, X-Formation provides a Software Bill of Materials (SBOM) in CycloneDX format. The SBOM identifies the included software components and their dependencies, including version and license information. It helps you assess the impact of known vulnerabilities.

The SDK and End-User Tools (EUT) installers each include separate sbom.json and vex.json files in the sbom folder of their respective installation directories. The Vulnerability Exploitability eXchange (VEX) file describes the status of identified vulnerabilities affecting components in the corresponding SBOM.