diid

Appearance

SBOM Visualizer ​

The Software Bill of Materials (SBOM) Visualizer provides complete supply chain and multi-level dependency graph visibility for every version of your libraries and services.

Availability: The SBOM Visualizer is available on all paid plans (Pro, Business, and Enterprise).

Key Capabilities ​

  • Interactive Graph Visualization: Fast, hardware-accelerated Cytoscape rendering with Dagre hierarchical layout. Clicking any package highlights upstream dependents (who requires it) and downstream dependencies (what it requires) while dimming unrelated packages.
  • Universal Standards: Seamlessly parses CycloneDX JSON (1.4, 1.5, 1.6) and SPDX JSON (2.2, 2.3).
  • Direct vs. Transitive Separation: Automatic Breadth-First Search (BFS) graph depth analysis categorizing direct dependencies (depth 1) from deep transitive sub-dependencies (depth > 1).
  • License & Ecosystem Audit: Comprehensive breakdown of open-source licenses and package ecosystems (npm, golang, pypi, cargo, maven, hex, nuget, etc.).
  • Per-Version History: Switch between any released version of a project to inspect how dependencies evolved between releases.
  • Table & Graph Views: Table view is the default for fast searching, sorting, and license audits. Switch to the interactive graph view at any time for visual exploration.
  • Scope Filtering: Filter by All, Direct, or Transitive dependencies across both table and graph views.

Uploading SBOMs ​

1. Using the diid-push CLI (Recommended) ​

Upload an SBOM JSON file directly using your project's push token:

bash
# Upload a local SBOM file
diid-push sbom bom.json --token $DIID_PUSH_TOKEN

# Explicitly override the release version
diid-push sbom bom.json --token $DIID_PUSH_TOKEN --version v2.1.0

Piping from Build and Security Scanners ​

You can pipe directly from tools such as Syft, Trivy, or cdxgen using - (standard input):

bash
# Syft
syft dir:. -o cyclonedx-json | diid-push sbom - --token $DIID_PUSH_TOKEN

# Trivy
trivy fs --format cyclonedx --output - . | diid-push sbom - --token $DIID_PUSH_TOKEN

2. Uploading via the Web Dashboard ​

  1. Navigate to SBOMs in the sidebar.
  2. Click Upload SBOM.
  3. Select the target Project, specify an optional version override, and drag-and-drop your .json file.
  4. Click Upload & Visualize.

Viewing & Filtering Dependencies ​

  • Table View (Default): Search packages by name, ecosystem, or license. Click Inspect in Graph on any row to jump directly to that node in graph view.
  • Graph View: Click any package to highlight upstream dependents (who requires it) and downstream dependencies (what it requires). Floating controls support zoom, fit-to-screen, and resetting highlights.
  • Scope Filters: Toggle between All, Direct, or Transitive to update the table rows and graph canvas simultaneously.

Security & Data Privacy ​

  • Encryption at Rest: All uploaded SBOM files and parsed dependency graphs are encrypted at rest with AES-256.
  • Tenant Isolation: Supply chain data is strictly isolated per organization.
  • Complete Erasure: Deleting a project or organization permanently purges all associated SBOM data and files.