Software-as-a-Service BOM
Describes cloud-native systems: microservices, FaaS, and the data that moves between them, including whether a call crosses a trust boundary.
Spec focus
services[], endpoints, data, authentication
Graph labels
BomDocument, Service, Endpoint, DataClassification, Component
Lifecycle
operations
Mapping. services[] become :Service nodes. Endpoint URIs and data classifications are split out so Cypher can ask which PII leaves the boundary.
Extension. TrustBoundary is modeled as a KnowledgeConcept. CALLS edges from components to services reconstruct runtime identity of the SaaS surface.
Documents
HarborPulse SaaS BOM
urn:uuid:7a2e1c90-aa11-4b33-9d01-saas0002
Subject — · v2 · 2026-03-18T14:40:00Z
Open in graphNeighborhood
Drag to pan · scroll to zoom · 10 nodes · 9 edges
Select a node to inspect CycloneDX properties.
Sample Cypher
All BOM documents
Every CycloneDX document in the Atlas graph, with its type.
SaaS data flows
Services, endpoints, and classified data — including trust-boundary crossings.
Components shared across BOM types
Inventory that appears in more than one BOM variety — the knowledge-graph payoff.
Knowledge concept overlay
How CycloneDX instances map onto the Atlas ontology.
Graph size by label
How many Atlas nodes exist for each CycloneDX class.
Neighborhood of HarborPulse API
One- and two-hop context around the application component.
Services, endpoints, trust boundaries, and data flows.