Skip to content

Moraph for clients

Sign in

Getting started

Getting started with Software Bill of Materials (SBOM) Watchtower

What Software Bill of Materials (SBOM) Watchtower is for, who uses it, what you need before you start, and your first steps.

Applies to Software Bill of Materials (SBOM) Watchtower as it works today. Moraph updates the platform continuously, and this page is reviewed when it changes.

Last reviewed 2 min readReport a problem
On this page
  1. What it is for
  2. Who uses it
  3. Before you start
  4. Steps to get started
  5. Where to go next

SBOM Watchtower checks software at the point of intake: it collects or generates a software bill of materials for each package, decomposes binaries and containers to find nested dependencies, and matches every component against known vulnerabilities and your own supplier and provenance policies. Packages that break a policy are held for a decision by your authorizing staff rather than passing through unseen. Each decision keeps its evidence, so your program can show what was admitted, why, and what changed when a new vulnerability was published.

What it is for

Defense programs take in software from primes, subcontractors, open-source projects and commercial vendors, often as compiled binaries with little documentation of what they contain. A vulnerable library several layers down can sit unnoticed until it is exploited, and when a new vulnerability is announced, teams spend days working out which systems are affected. Supplier SBOMs arrive in different formats or not at all, provenance requirements are checked by hand, and the record of why a package was approved is spread across tickets and email.

  • Compiled software arrives without a reliable list of the components inside it
  • Nested dependencies hide vulnerable or prohibited components several layers down
  • Answering "are we affected?" after a new vulnerability takes a manual search
  • Approval decisions and their evidence are hard to produce for assessors

Who uses it

  • Software supply chain and cyber security teams in defense programs and commands
  • Authorizing officials and information system security managers who approve software for use
  • Program offices that receive software deliveries from primes and subcontractors
  • DevSecOps platform teams running software factories and artifact repositories
  • Assessors and inspectors general who need evidence of supply chain controls

Before you start

  • Your organization licenses Software Bill of Materials (SBOM) Watchtower from Moraph.
  • A Moraph client account in that organization, signed in.
  • Access to Software Bill of Materials (SBOM) Watchtower in Moraph Apps, given by an administrator in the Moraph Portal under People and access.
  • For setup: the product administrator role.

Steps to get started

  1. Sign in at app.moraph.com with your Moraph account.

  2. Open Software Bill of Materials (SBOM) Watchtower from the launcher. The first time anyone opens it, its workspace is created from the default described in Workspace reference.

  3. Check your role: what you can see and do depends on it. See Roles and permissions.

  4. Product administrators: work through Set up Software Bill of Materials (SBOM) Watchtower before your team starts.

  5. Everyone else: start with Everyday tasks.

Where to go next

Was this page helpful?

Report a problem with this page
What’s the problem?
Quote the step or heading if you can. Don’t include passwords or personal records.
Only if you’d like a reply. We use it for this report and nothing else.

Need help with your own setup rather than this page? Raise a support ticket.