sboms

Creates, updates, deletes, gets or lists a sboms resource.

Overview

Name	sboms
Type	Resource
Id	datadog.security.sboms

Fields

The following fields are returned by SELECT queries:

get_sbom

Name	Datatype	Description
id	string	The unique ID for this SBOM (it is equivalent to the asset_name or asset_name@repo_digest (Image) (example: github.com/datadog/datadog-agent)
attributes	object	The JSON:API attributes of the SBOM.
type	string	The JSON:API type. (sboms) (example: sboms)

list_assets_sboms

Name	Datatype	Description
id	string	The unique ID for this SBOM (it is equivalent to the asset_name or asset_name@repo_digest (Image) (example: github.com/datadog/datadog-agent)
attributes	object	The JSON:API attributes of the SBOM.
type	string	The JSON:API type. (sboms) (example: sboms)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_sbom	select	asset_type, filter[asset_name]	filter[repo_digest], ext:format	Get a single SBOM related to an asset by its type and name.
list_assets_sboms	select		page[token], page[number], filter[asset_type], filter[asset_name], filter[package_name], filter[package_version], filter[license_name], filter[license_type]	Get a list of assets SBOMs for an organization.<br /><br />The filter&#91;asset_type&#93; parameter is required for initial requests (when no page&#91;token&#93; is provided).<br />Subsequent pages encode the asset type in the pagination token, so filter&#91;asset_type&#93; is not required<br />for paginated requests. Mixing infrastructure asset types (Host, HostImage, Image, ServerlessFunction)<br />with code asset types (Repository, Service) in the same request is not supported and returns a 400 error.<br /><br />### Pagination<br /><br />Please review the [Pagination section](#pagination) for the "List Vulnerabilities" endpoint.<br /><br />### Filtering<br /><br />Please review the [Filtering section](#filtering) for the "List Vulnerabilities" endpoint.<br /><br />### Metadata<br /><br />Please review the [Metadata section](#metadata) for the "List Vulnerabilities" endpoint.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
asset_type	string	The type of the asset for the SBOM request.
filter[asset_name]	string	The name of the asset for the SBOM request. (example: github.com/datadog/datadog-agent)
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.
ext:format	string	The standard of the SBOM.
filter[asset_name]	string	The name of the asset for the SBOM request. (example: github.com/datadog/datadog-agent)
filter[asset_type]	string	The type of the assets for the SBOM request. Required for initial requests (when no page[token] is provided). Infrastructure types (Host, HostImage, Image, ServerlessFunction) and code types (Repository, Service) cannot be mixed in the same request.
filter[license_name]	string	The software license name of the component that is a dependency of an asset. (example: Apache-2.0)
filter[license_type]	string	The software license type of the component that is a dependency of an asset.
filter[package_name]	string	The name of the component that is a dependency of an asset. (example: opentelemetry-api)
filter[package_version]	string	The version of the component that is a dependency of an asset. (example: 1.33.1)
filter[repo_digest]	string	The container image repo_digest for the SBOM request. When the requested asset type is 'Image', this filter is mandatory. (example: sha256:0ae7da091191787229d321e3638e39c319a97d6e20f927d465b519d699215bf7)
page[number]	integer (int64)	The page number to be retrieved. It should be equal to or greater than 1. (example: 1)
page[token]	string	Its value must come from the links section of the response of the first request. Do not manually edit it. (example: b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4)

SELECT examples

get_sbom

Get a single SBOM related to an asset by its type and name.

SELECT
id,
attributes,
type
FROM datadog.security.sboms
WHERE asset_type = '{{ asset_type }}' -- required
AND filter[asset_name] = '{{ filter[asset_name] }}' -- required
AND filter[repo_digest] = '{{ filter[repo_digest] }}'
AND ext:format = '{{ ext:format }}'
;

list_assets_sboms

Get a list of assets SBOMs for an organization.<br /><br />The filter[asset_type] parameter is required for initial requests (when no page[token] is provided).<br />Subsequent pages encode the asset type in the pagination token, so filter[asset_type] is not required<br />for paginated requests. Mixing infrastructure asset types (Host, HostImage, Image, ServerlessFunction)<br />with code asset types (Repository, Service) in the same request is not supported and returns a 400 error.<br /><br />### Pagination<br /><br />Please review the [Pagination section](#pagination) for the "List Vulnerabilities" endpoint.<br /><br />### Filtering<br /><br />Please review the [Filtering section](#filtering) for the "List Vulnerabilities" endpoint.<br /><br />### Metadata<br /><br />Please review the [Metadata section](#metadata) for the "List Vulnerabilities" endpoint.

SELECT
id,
attributes,
type
FROM datadog.security.sboms
WHERE page[token] = '{{ page[token] }}'
AND page[number] = '{{ page[number] }}'
AND filter[asset_type] = '{{ filter[asset_type] }}'
AND filter[asset_name] = '{{ filter[asset_name] }}'
AND filter[package_name] = '{{ filter[package_name] }}'
AND filter[package_version] = '{{ filter[package_version] }}'
AND filter[license_name] = '{{ filter[license_name] }}'
AND filter[license_type] = '{{ filter[license_type] }}'
;