Quick Start Guide: Generate Your First SBOM in 10 Minutes

Choose Your Path

Start with the path that matches what you have in front of you. The best first SBOM is the one that describes the artifact you actually need to review or share.

What You Will Do

In one short session you will:

1. install or run an SBOM generator
2. create a CycloneDX or SPDX file
3. validate the output
4. decide what to do next with the result

Option 1: Universal SBOM Generation with Syft

Step 1: Install Syft

Use the installation method that matches your environment.

brew install syft

curl -sSfL https://get.anchore.io/syft | sh -s -- -b /usr/local/bin

winget install Anchore.Syft

docker run --rm -v "$(pwd)":/src anchore/syft:latest dir:/src -o cyclonedx-json=/src/sbom.json

Step 2: Generate Your First SBOM

From your project root, run one of these commands:

# CycloneDX JSON
syft dir:. -o cyclonedx-json=sbom.json

# SPDX JSON
syft dir:. -o spdx-json=sbom-spdx.json

If you only want one output format at the start, use CycloneDX. It is usually the easiest format for a first security-oriented workflow.

Step 3: Inspect the Output

# Pretty print the SBOM
jq '.' sbom.json

# Count components
jq '.components | length' sbom.json

# Show package names and versions
jq '.components[] | {name: .name, version: .version}' sbom.json

If your file contains package names, versions, and metadata, you already have a workable first SBOM.

Step 4: Validate the SBOM

Do this before you share or automate anything.

Fastest option

CLI examples

# Validate CycloneDX with the CycloneDX CLI
cyclonedx validate --input-file sbom.json

# Validate SPDX with tools-python
pyspdxtools -i sbom-spdx.json

Validation catches format errors, missing required fields, and common structural issues before the SBOM enters a downstream workflow.

Option 2: Language-Specific Generators

If you want tighter integration with a package manager or build system, use a language-specific tool.

JavaScript and Node.js

npm install --global @cyclonedx/cyclonedx-npm
cyclonedx-npm --output-format JSON --output-file sbom.json

Python

pip install cyclonedx-bom
cyclonedx-py -r requirements.txt -o sbom.json

Java with Maven

mvn cyclonedx:makeAggregateBom

Go

go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
cyclonedx-gomod mod -json -output sbom.json

Rust

cargo install cargo-cyclonedx
cargo cyclonedx --format json --output sbom.json

What a Basic SBOM Looks Like

A minimal CycloneDX JSON file usually includes:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "version": 1,
  "metadata": {
    "timestamp": "2026-03-09T12:00:00Z",
    "component": {
      "type": "application",
      "name": "my-app",
      "version": "1.0.0"
    }
  },
  "components": [
    {
      "type": "library",
      "name": "express",
      "version": "4.18.2",
      "purl": "pkg:npm/express@4.18.2"
    }
  ]
}

The important fields for beginners are:

• bomFormat: the SBOM format
• metadata: who or what generated the file
• components: the actual inventory of software pieces
• purl: the package identifier used by many downstream tools

What to Do Next

1. Run vulnerability analysis

If your goal is security, scan the generated SBOM with a tool such as Grype or another vulnerability platform that accepts SBOM input.

2. Add SBOM generation to CI/CD

Your first manual SBOM is only a starting point. The real value comes when every release produces one automatically.

3. Compare tooling options

4. Learn the format tradeoffs

Common Problems

Before assuming the generator failed, check the artifact you scanned. Many first SBOM problems come from scanning the wrong directory, scanning source when you meant to scan a container image, or validating an old file from a previous build.

No packages found

You may be running the generator from the wrong directory or scanning a project without installed dependencies. For source scans, run the command from the project root where the manifest or lock file lives. For release checks, scan the built image or artifact instead.

Missing transitive dependencies

Some tools see more than others depending on build context. If the output looks thin, compare a filesystem scan with a build-tool-native generator.

Validation errors

Recommended Path After This Page

1. What Is an SBOM?
2. SBOM Formats
3. SBOM Validator
4. SBOM Tools Comparison
5. SBOM Vulnerability Management

Bottom Line

Do not overcomplicate your first SBOM.

Generate one file, validate it, confirm the component inventory looks reasonable, and then automate the workflow. That alone puts you ahead of most teams that are still treating SBOMs as a future project.