Find assets and export SBOMs

Use this article when you need to find repositories, applications, manifests, packages, or SBOM exports in Cysmiq.

What counts as an asset

• Organizations: GitHub organizations, GitLab groups, or other VCS structures synced from integrations.
• Repositories: scanned code repositories.
• Applications: manually created groups of related repositories for product-level reporting.
• Manifests: dependency files discovered during scans, such as package.json, requirements.txt, or go.mod.
• Packages: dependencies declared in manifests, including the versions Cysmiq detects.

Where to look

• Use Repositories to review scan status, refs, findings, repository settings, and repository-level SBOM exports.
• When available, open a repository's Endpoints tab to review discovered HTTP routes and linked code findings.
• The Repositories and Scans views show available repositories by default. Set Availability to Orphaned or All when an expected repository or its scans are missing.
• Use Applications to group related repositories and export application-level SBOMs.
• Use Manifests to inspect dependency files and dependency trees.
• Use Packages to find where a package or package version is used.

SBOM exports

• Cysmiq exports SBOMs in CycloneDX JSON or XML.
• Application exports aggregate manifests across linked repositories.
• Repository exports include all manifests discovered in that repository.
• Manifest exports cover a single dependency file.
• Larger exports may be queued, and Cysmiq notifies you when the file is ready.

Canonical docs

For the maintained reference, see Assets, SBOMs, Applications, Repositories, Packages, and Scan list view.

Contact support if

• An expected repository, manifest, package, or application is missing after checking the available filters.
• A package usage drilldown does not lead to the expected repositories or manifests.
• An SBOM export fails, stays queued longer than expected, or has missing package data.