CLI Commands

cnspec sbom

Generate a software bill of materials (SBOM) for a given asset.

Generate a software bill of materials (SBOM) for a given asset. The SBOM is a representation of the asset's software components and their dependencies. This command is experimental and may change in the future.

cnspec sbom local

Generate an SBOM in CycloneDX JSON format:

cnspec sbom local -o cyclonedx-json

Generate an SBOM for a container image:

cnspec sbom container IMAGE_NAME

Generate an SBOM for a remote system:

cnspec sbom ssh user@HOST

To generate SBOMs for the assets in an inventory file, using the credentials it defines, pass --inventory-file instead of a provider subcommand:

cnspec sbom --inventory-file inventory.yml -o cyclonedx-json --output-target sbom.json

An inventory with several assets produces one SBOM per asset. With --output-target, cnspec writes each SBOM to its own file, inserting the asset's index before the extension (sbom-0.json, sbom-1.json, and so on), in order of asset name. Without --output-target, cnspec prints them one after another. Assets that cnspec can't scan get no SBOM. cnspec lists them and exits with status 1 after it writes the others.

The following output formats are supported:

  • json
  • cyclonedx-json
  • cyclonedx-xml
  • spdx-json
  • spdx-tag-value
  • spdx3-json
  • table (default)

cnspec checks the output format before it scans, and exits with an error if you pass a format it doesn't support.

Options

      --annotation stringToString     Add an annotation to the asset in the form KEY=VALUE (default [])
      --asset-name string             User-override for the asset name
      --discover strings              Enable the discovery of nested assets. Supports: all, auto, container, container-images, mcp-servers
  -h, --help                          help for sbom
      --inventory-file string         Set the path to the inventory file. With several assets, --output-target gets one file per asset
      --inventory-format-ansible      Set the inventory format to Ansible
      --inventory-format-domainlist   Set the inventory format to domain list
  -o, --output string                 Set output format: json, cyclonedx-json, cyclonedx-xml, spdx-json, spdx-tag-value, spdx3-json, table (default "table")
      --output-target string          Set output target to which the SBOM report will be written
      --record string                 Record all resource calls and use resources in the recording
      --sudo                          Elevate privileges with sudo
      --use-recording string          Use a recording to inject resource data (read-only)
      --with-cpes                     Generate CPEs for each component
      --with-evidence                 Include evidence for each component

Options inherited from parent commands

      --api-proxy string        Set the proxy for communications with Mondoo Platform API
      --auto-update             Enable automatic updates of cnspec and its providers; overrides auto_update in the config file (default true)
      --config string           Set config file path (default $HOME/.config/mondoo/mondoo.yml)
      --log-level string        Set the log level: error, warn, info, debug, trace (default "info")
      --logging-config string   Path to a logging configuration file (YAML or JSON) that selects the log writer, level, and writer-specific options
      --strict                  Default MQL strict mode for policies that do not declare one: every link in an MQL chain must resolve
  -v, --verbose                 Enable verbose output

SEE ALSO

cnspec run

Run an MQL query on the command line and display the results.

cnspec scan

Run a security scan on an asset based on one or more Mondoo policies.

On this page

OptionsOptions inherited from parent commandsSEE ALSO