---
updatedAt: 2026-06-04T21:21:24.000Z
agentTools:
  projectIndex: https://docs.query.ai/llms.txt
---

# Software Bill of Materials

<code>sbom</code>

The Software Bill of Materials object describes characteristics of a generated SBOM.

## Attributes

<table>
    <tr><th>Caption</th><th>Name</th><th>Type</th><th>Description</th></tr>
    <tr id="attr-created_time">
        <td>Created Time</td>
        <td><code>created_time</code></td>
        <td>
            <a href="/docs/types#timestamp_t">Timestamp</a>
        </td>
        <td>
        The time when the SBOM was created.
        
        </td>
    </tr>
    <tr id="attr-package">
        <td>Software Package</td>
        <td><code>package</code></td>
        <td>
            <a href="/docs/obj-package">Software Package[]</a>
        </td>
        <td>
        The software package or library that is being discovered or inventoried by an SBOM.
        
        </td>
    </tr>
    <tr id="attr-product">
        <td>Product</td>
        <td><code>product</code></td>
        <td>
            <a href="/docs/obj-product">Product[]</a>
        </td>
        <td>
        Details about the upstream product that generated the SBOM e.g. cdxgen or Syft.
        
        </td>
    </tr>
    <tr id="attr-raw_data">
        <td>Raw Data</td>
        <td><code>raw_data</code></td>
        <td>
            <a href="/docs/types#json_t">JSON</a>
        </td>
        <td>
            <strong>Group:</strong><code>context</code><br/>
        The event data as received from the event source.
        
        </td>
    </tr>
    <tr id="attr-record_id">
        <td>Record ID</td>
        <td><code>record_id</code></td>
        <td>
            <a href="/docs/types#string_t">String</a>
        </td>
        <td>
            <strong>Group:</strong><code>primary</code><br/>
        Unique identifier for the object
        
        </td>
    </tr>
    <tr id="attr-software_components">
        <td>Software Components</td>
        <td><code>software_components</code></td>
        <td>
            <a href="/docs/obj-software_component">Software Component[]</a>
        </td>
        <td>
        The list of software components used in the software package.
        
        </td>
    </tr>
    <tr id="attr-type">
        <td>Type</td>
        <td><code>type</code></td>
        <td>
            <a href="/docs/types#string_t">String</a>
        </td>
        <td>
        The type of SBOM, normalized to the caption of the type_id value. In the case of &#39;Other&#39;, it is defined by the source.
        
        </td>
    </tr>
    <tr id="attr-type_id">
        <td>Type ID</td>
        <td><code>type_id</code></td>
        <td>
            <a href="/docs/types#integer_t">Integer</a>
        </td>
        <td>
        The type of SBOM.
        
            <ul>
                <li><code>1</code>: SPDX (<code>SPDX</code>)</li>
                <li><code>2</code>: CycloneDX (<code>CYCLONEDX</code>)</li>
                <li><code>3</code>: SWID (<code>SWID</code>)</li>
                <li><code>0</code>: Unknown (<code>UNKNOWN</code>)</li>
                <li><code>99</code>: Other (<code>OTHER</code>)</li>
            </ul>
        </td>
    </tr>
    <tr id="attr-uid">
        <td>SBOM ID</td>
        <td><code>uid</code></td>
        <td>
            <a href="/docs/types#string_t">String</a>
        </td>
        <td>
        A unique identifier for the SBOM or the SBOM generation by a source tool, such as the SPDX metadata.component.bom-ref.
        
        </td>
    </tr>
    <tr id="attr-unmapped">
        <td>Unmapped</td>
        <td><code>unmapped</code></td>
        <td>
            <a href="/docs/obj-unmapped">Unmapped[]</a>
        </td>
        <td>
        Data from the source that was not mapped into the schema.
        
        </td>
    </tr>
    <tr id="attr-version">
        <td>Version</td>
        <td><code>version</code></td>
        <td>
            <a href="/docs/types#string_t">String</a>
        </td>
        <td>
        The specification (spec) version of the particular SBOM, e.g., 1.6.
        
        </td>
    </tr>
</table>

## Relationships

<img src="https://schema.query.ai/images/obj-sbom.svg" alt="Software Bill of Materials shown in context" />

### Inbound Relationships

These objects and events reference Software Bill of Materials in their attributes:

<ul>
    <li><a href="/docs/event-software_info">Software Inventory Info</a></li>
    <li><a href="/docs/obj-application">Application</a></li>
</ul>

### Outbound Relationships

Software Bill of Materials references the following objects and events in its attributes:

<ul>
    <li><a href="/docs/obj-software_component">Software Component</a></li>
    <li><a href="/docs/obj-package">Software Package</a></li>
    <li><a href="/docs/obj-product">Product</a></li>
    <li><a href="/docs/obj-unmapped">Unmapped</a></li>
</ul>

<p><small><i>This page describes qdm-1.5.1+ocsf-1.6.0</i></small></p>