OWASP CycloneDX · ECMA-424
A field guide to every BOM, stored as a knowledge graph.
Atlas replicates the CycloneDX object model in Memgraph, extends it with an ontology overlay, and ships a synthetic HarborPulse corpus so each BOM variety can be queried in Cypher.
Atlas nodes
148
Labeled :Cdx in Memgraph, isolated from other graphs on the instance.
Relationships
242
DEPENDS_ON, AFFECTS, PRODUCED_BY, MAPS_TO, and the rest of the model.
Host
Memgraph 3.6.0
21,921 nodes on the instance · bolt://memgraph:7687
Ten BOM models
Each tile is a live document in the HarborPulse corpus.
Software Bill of Materials
Inventory of software components, licenses, and dependency edges.
SaaSBOMSoftware-as-a-Service BOM
Services, endpoints, trust boundaries, and data flows.
HBOMHardware Bill of Materials
Devices, boards, firmware, and manufacturer pedigree.
ML-BOMMachine Learning BOM
Models, datasets, training lineage, and intended use.
CBOMCryptography Bill of Materials
Algorithms, protocols, certificates, and keys in use.
OBOMOperations Bill of Materials
Runtime inventory: OS, configs, orchestrators, observed state.
MBOMManufacturing Bill of Materials
Formulas, workflows, tasks, and the tools that built the product.
VDRVulnerability Disclosure Report
Known vulnerabilities affecting components or services.
VEXVulnerability Exploitability eXchange
Whether a vulnerability is actually exploitable in this product.
CDXACycloneDX Attestations
Claims, evidence, and conformance against named standards.
Try a query
Sample Cypher against the seeded graph. Open any one in the console.
- All BOM documentsEvery CycloneDX document in the Atlas graph, with its type.
- SBOM dependency treeDirect and transitive DEPENDS_ON edges under the HarborPulse Cloud API.
- License blast radiusWhich licenses appear, and which components carry them.
- SaaS data flowsServices, endpoints, and classified data — including trust-boundary crossings.
- Hardware compositionThe Edge Gateway and every part it is COMPOSED_OF.
- ML model lineageFrom dataset through model card to the component that ships the model.
HarborPulse
One fictional warehouse IoT product, ten BOMs. Cloud API, edge gateway, anomaly model, crypto, factory formula, VEX, and an SSDF attestation — linked so a CVE can walk to a device.