Reference
Software Bill of Materials (SBOM) Watchtower glossary
Terms used in Software Bill of Materials (SBOM) Watchtower and its documentation.
Applies to Software Bill of Materials (SBOM) Watchtower as it works today. Moraph updates the platform continuously, and this page is reviewed when it changes.
Terms used in Software Bill of Materials (SBOM) Watchtower and its documentation.
| Term | Meaning |
|---|---|
| SBOM | Software bill of materials: a list of the components and versions inside a piece of software. |
| SPDX and CycloneDX | The two standard SBOM formats Watchtower reads and writes. |
| VEX | Vulnerability Exploitability eXchange: a supplier statement on whether a known vulnerability affects their product. |
| KEV | The CISA Known Exploited Vulnerabilities catalog of vulnerabilities known to be exploited. |
| Binary decomposition | Unpacking a package and analyzing its binaries to identify the components inside, including bundled libraries. |
| Quarantine | Where a package waits, unexecuted, until a decision is recorded. |
| Conditional admission | Admitting a package with conditions, an owner and a review date, recorded as a waiver. |
| Continuous watch | Re-checking stored SBOMs whenever new vulnerability data arrives. |
| Provenance | Evidence of where and by whom software or a component was produced. |
| Unidentified code | Binaries Watchtower could not match to a known component, reported rather than assumed safe. |
Was this page helpful?
Report a problem with this page
Need help with your own setup rather than this page? Raise a support ticket.