VISTASecurity
Get Core Free

Practical guides

How to generate a CBOM with free Vista Platform Core

From observed cryptography to a scoped CycloneDX file you can download and check.

Vista Security · Reviewed

To generate a CBOM in Vista Platform Core, collect and approve discovery evidence, choose a Scope, open Risk & Compliance → Bills of Materials, and generate a Cryptographic (CBOM) artifact. Download its canonical CycloneDX JSON and compare its SHA-256 hash with the artifact record. Generation and CycloneDX export are included in free Core.

A Cryptographic Bill of Materials (CBOM) records the cryptographic components observed within a defined boundary. It complements a software bill of materials (SBOM), which describes software composition. This guide follows Vista Platform Core documentation; labels can differ on older releases.

1. Prepare your installation

Vista Platform Core is a free, self-hosted infrastructure inventory, DCIM, and IPAM platform with cryptographic posture built in. It includes discovery, the internal infrastructure workspace, compliance and PQC assessment, and CBOM generation without asset, sensor, seat, or time caps. You provide the infrastructure and operate it. Core is proprietary software under the Vista Platform License, version 1.0. The sensor and device interrogation agent are open source under Apache-2.0.

You need a running Vista Platform Core installation, access to your organization, and at least one supported source of discovery evidence. A Tenant Admin manages Scopes. If you are starting fresh, follow the Docker or Kubernetes installation instructions, then the Quick Start. Use sources you own or are authorized to assess.

Start with a small boundary you can explain: for example, a lab application and its supporting hosts. Document what you intend to cover before collecting data. An empty installation can produce little useful evidence.

2. Collect and approve evidence

Connect a supported discovery source: a network sensor, device interrogation, a host collection path, or a cloud integration. Follow the discovery guide for that source. Coverage depends on visibility, permissions, supported protocols, and the time of observation.

Open Discovery → Approvals and review discoveries waiting for acceptance. Unless auto-approval applies, discovered assets and their cryptographic evidence stay out of Inventory until accepted. Then inspect Inventory: check certificates, keys, and configurations, and review the source evidence. A discovery job completing does not establish complete coverage.

3. Choose a scope

Open Settings → Scopes as a Tenant Admin. For a first baseline in an isolated evaluation tenant, the default All scope covers that tenant’s inventory. For a narrower boundary, select New Scope, give it a meaningful name, enter an inventory query, use Preview, and save.

For example, environment:production includes assets recorded as production. Check those labels first: an unlabelled asset will not match that query. Compare the preview against the systems you expected to include. Read about scope queries and versioning.

4. Generate and download the CBOM

  1. Open Risk & Compliance → Bills of Materials.
  2. Click Generate and leave Kind set to Cryptographic (CBOM).
  3. Select the Scope you reviewed. Optionally name the artifact, such as “Lab application baseline”.
  4. Click Generate. Open the new artifact and review its scope, generation time, and entry count.
  5. Use Download → CycloneDX 1.7 (.json) to save the canonical file.

The artifact is a frozen snapshot. Generating again creates a new artifact; it does not update the old one. You can capture a baseline while findings remain unresolved. Generation is on demand; scheduled artifact delivery is not a current capability.

5. Check the artifact before sharing it

Keep the original downloaded bytes. If you name the file cbom.json, these commands calculate its hash:

Linux

sha256sum cbom.json

macOS

shasum -a 256 cbom.json

Windows PowerShell

Get-FileHash -Algorithm SHA256 .\cbom.json

Compare the result with the full SHA-256 value on the artifact detail. Reformatting the JSON changes its bytes and therefore its hash. A matching hash establishes agreement with that recorded value; it does not prove complete discovery or organizational compliance.

  • Format: confirm bomFormat is CycloneDX and inspect specVersion.
  • Contents: review components and their cryptographic properties against the expected inventory.
  • Boundary: retain the artifact’s Scope name/version and generation time with your review notes.
  • Schema: validate against the matching CycloneDX specification using a validator that supports that version. Schema validity and discovery completeness are different checks.
  • Gaps: record unreachable sources, stale observations, unassessed items, and exclusions alongside the artifact.

If the result is empty or unexpected

Discovery ran, but Inventory is empty
Review Discovery → Approvals before generating again.
The scope contains fewer assets than expected
Preview its query and inspect environment labels, tags, and exclusions. Asset counts and CBOM component counts measure different things.
A sensor is connected but finds nothing
Check interface selection and traffic visibility. No observation is not proof that no cryptography exists.
A cloud run is incomplete
Inspect Discovery Jobs for denied resource types or failed regions and correct the source configuration.
PDF or SPDX downloads are unavailable
Core exports CycloneDX. PDF/SPDX projections, signing, attestation, and artifact comparison are Enterprise capabilities.

What comes after the first CBOM?

Review findings, assign work, make changes in the underlying systems, collect fresh evidence, and generate a new baseline. Vista tracks and governs the process; generating a CBOM does not migrate the cryptography. See the CBOM capability and edition overview.