Software Bill of Materials
The canonical CycloneDX use case: a complete inventory of first-party and third-party software, with purls, hashes, licenses, and a dependency graph.
Spec focus
components[], dependencies[], metadata.component
Graph labels
BomDocument, Component, License, Organization, Tool
Lifecycle
build
Mapping. Mapped almost 1:1. Each CycloneDX component becomes a :Component node keyed by bom-ref; dependencies[] become DEPENDS_ON edges. Pedigree, supplier, and hashes are first-class nodes or properties.
Extension. Atlas adds :KnowledgeConcept MAPS_TO links so an npm library can be reasoned about as a SupplyChainNode, not only as a JSON blob.
Documents
HarborPulse Cloud API SBOM
urn:uuid:7a2e1c90-aa11-4b33-9d01-sbom0001
Subject HarborPulse Cloud API · v3 · 2026-03-18T14:22:00Z
Open in graphNeighborhood
Drag to pan · scroll to zoom · 24 nodes · 24 edges
Select a node to inspect CycloneDX properties.
Sample Cypher
All BOM documents
Every CycloneDX document in the Atlas graph, with its type.
SBOM dependency tree
Direct and transitive DEPENDS_ON edges under the HarborPulse Cloud API.
License blast radius
Which licenses appear, and which components carry them.
Exploitable paths to hardware
From an exploitable CVE, walk software dependents until a device is reached.
Components shared across BOM types
Inventory that appears in more than one BOM variety — the knowledge-graph payoff.
Knowledge concept overlay
How CycloneDX instances map onto the Atlas ontology.
Graph size by label
How many Atlas nodes exist for each CycloneDX class.
Neighborhood of HarborPulse API
One- and two-hop context around the application component.
Inventory of software components, licenses, and dependency edges.