CycloneDX object model
From JSON document to graph.
CycloneDX is a single object model that happens to cover many BOM varieties. Atlas keeps that fidelity, then promotes nested objects into nodes so Cypher can traverse them.
Document spine
- bomFormat / specVersion / serialNumber — identity of the document, stored on :BomDocument.
- metadata — timestamp, tools, authors, supplier, and the subject component become CREATED_BY, AUTHORED_BY, DECLARED_BY, DESCRIBES.
- components[] / services[] — inventory nodes, linked with INCLUDES.
- dependencies[] — DEPENDS_ON edges using bom-ref.
- vulnerabilities[], formulation[], declarations[] — risk, process, and trust subgraphs.
What Atlas extends
- Shared label :Cdx so this corpus can live beside other graphs.
- :KnowledgeConcept overlay — SoftwareComponent, TrustBoundary, ManufacturingStep, and the rest — via MAPS_TO.
- RELATED_BOM between documents so VEX, VDR, SBOM, HBOM, CBOM, and CDXA are one connected product story.
- VEX analysis and crypto properties lifted out of nested JSON into first-class nodes.
BOM varieties
build
Software Bill of Materials
The canonical CycloneDX use case: a complete inventory of first-party and third-party software, with purls, hashes, licenses, and a dependency graph.
Spec focus. components[], dependencies[], metadata.component
Graph mapping. Mapped almost 1:1. Each CycloneDX component becomes a :Component node keyed by bom-ref; dependencies[] become DEPENDS_ON edges. Pedigree, supplier, and hashes are first-class nodes or properties.
Extension. Atlas adds :KnowledgeConcept MAPS_TO links so an npm library can be reasoned about as a SupplyChainNode, not only as a JSON blob.
BomDocument · Component · License · Organization · Tool → INCLUDES, DESCRIBES, DEPENDS_ON, LICENSED_UNDER, SUPPLIED_BY
operations
Software-as-a-Service BOM
Describes cloud-native systems: microservices, FaaS, and the data that moves between them, including whether a call crosses a trust boundary.
Spec focus. services[], endpoints, data, authentication
Graph mapping. services[] become :Service nodes. Endpoint URIs and data classifications are split out so Cypher can ask which PII leaves the boundary.
Extension. TrustBoundary is modeled as a KnowledgeConcept. CALLS edges from components to services reconstruct runtime identity of the SaaS surface.
BomDocument · Service · Endpoint · DataClassification · Component → INCLUDES_SERVICE, PROVIDES, PROCESSES, CALLS
pre-build
Hardware Bill of Materials
Fills the gap between an electrical BOM and a manufacturing BOM for IoT, ICS, and embedded products.
Spec focus. components[type=device|firmware|platform]
Graph mapping. Hardware is still a CycloneDX component with type device/firmware. COMPOSED_OF captures the physical bill; firmware is a component that RUNS_ON the MCU.
Extension. Manufacturer and part identifiers are queryable. Hardware nodes link to the CBOM (crypto in silicon) and MBOM (how the board was built).
BomDocument · Component · Organization → INCLUDES, COMPOSED_OF, MANUFACTURED_BY, CONTAINS
build
Machine Learning BOM
Gives visibility into security, privacy, safety, and ethics of ML systems by listing models and the data that produced them.
Spec focus. components[type=machine-learning-model], modelCard, data
Graph mapping. modelCard fields become a :ModelCard node. Datasets are first-class so lineage queries can walk TRAINED_ON.
Extension. The anomaly model used on the HarborPulse gateway is linked to the SBOM (onnxruntime) and the HBOM (edge device it ships on).
BomDocument · Component · ModelCard · Dataset → INCLUDES, HAS_MODEL_CARD, TRAINED_ON
operations
Cryptography Bill of Materials
Cryptographic transparency: which primitives, protocols, and related material are present, and where they are implemented.
Spec focus. components[type=cryptographic-asset], cryptoProperties
Graph mapping. cryptoProperties are promoted to :CryptoAsset nodes (algorithm, protocol, certificate, key) rather than nested JSON.
Extension. PQC-readiness queries become Cypher: match algorithms whose primitive is not on an approved list. Certificates ISSUED_BY an organization.
BomDocument · CryptoAsset · Component → INCLUDES, USES_CRYPTO, ISSUED_BY, SIGNS
operations
Operations Bill of Materials
A point-in-time inventory of what is actually running — cluster, node OS, configuration, and deployed services.
Spec focus. components, configuration, services (observed)
Graph mapping. Configuration objects are :Configuration nodes with name/value so drift can be queried. Observed components are labeled with lifecycle=operations.
Extension. OBOM documents RELATED_BOM the SBOM of the same release, bridging declared vs observed inventory.
BomDocument · Component · Configuration · Service → INCLUDES, CONFIGURES, RUNS_ON, CALLS
build
Manufacturing Bill of Materials
Declares (or observes) how something was manufactured or deployed — the precise tasks, tools, and ingredients.
Spec focus. formulation[], workflow, task, steps
Graph mapping. formulation is decomposed into Formula → Workflow → Task. Component PRODUCED_BY Formula closes the loop to HBOM/SBOM.
Extension. Secure key injection is a Task that USES_TOOL a signing HSM, which also appears in the CBOM.
BomDocument · Formula · Workflow · Task · Tool · Component → PRODUCED_BY, HAS_WORKFLOW, HAS_TASK, USES_TOOL
post-build
Vulnerability Disclosure Report
Communicates known (and previously unknown) vulnerabilities inherited from third-party and first-party inventory.
Spec focus. vulnerabilities[], affects[], ratings[]
Graph mapping. Each vulnerabilities[] item is a :Vulnerability. affects[].ref becomes AFFECTS to a Component or Service.
Extension. Because inventory lives in the same graph, blast-radius queries hop from CVE → component → dependents → hardware device.
BomDocument · Vulnerability · Component → FOUND_IN, AFFECTS, RELATED_BOM
post-build
Vulnerability Exploitability eXchange
Separates 'a CVE exists in a dependency' from 'it is exploitable in our product', with machine-readable justifications.
Spec focus. vulnerabilities[].analysis (state, justification)
Graph mapping. analysis is a :VexAnalysis node (state, justification, response, detail) rather than a nested object, so status can be versioned.
Extension. VEX documents RELATED_BOM both the VDR and the SBOM they speak about, enabling 'show me unresolved exploitable paths'.
BomDocument · Vulnerability · VexAnalysis · Component → HAS_ANALYSIS, ANALYZES, AFFECTS, RELATED_BOM
post-build
CycloneDX Attestations
Compliance-as-code: an attestation that requirements of a standard are met, backed by claims and evidence.
Spec focus. declarations[], standards, claims, evidence
Graph mapping. definitions.standards and declarations are split into Standard, Requirement, Attestation, Claim, and Evidence nodes.
Extension. Evidence can point at a Component, Task, or CryptoAsset already in other BOMs — attestations are not an island.
BomDocument · Standard · Requirement · Attestation · Claim · Evidence → ATTESTS, CLAIMS, SATISFIES, SUPPORTED_BY
Graph families
Document
The BOM itself, its type, and notes attached to it.
BomDocument, Annotation
Inventory
Things the BOM enumerates: software, hardware, services, crypto, models, data.
Component, Service, Endpoint, DataClassification, CryptoAsset, ModelCard, Dataset
Identity
Who made, supplied, licensed, or authored the inventory.
Organization, Person, Tool, License
Risk
Vulnerabilities and VEX exploitability statements.
Vulnerability, VexAnalysis
Process
How it was built, configured, or operated.
Formula, Workflow, Task, Configuration
Trust
Attestations, claims, evidence, and standards.
Standard, Requirement, Attestation, Claim, Evidence
Ontology
Atlas knowledge concepts that sit above the CycloneDX classes.
BomType, KnowledgeConcept