Skip to main content

Connect without CI

Create a Generic project when you want Identify results—SBOMs, vulnerabilities, and license data—without connecting GitHub or GitLab. Protect and Monitor setup options are disabled for Generic projects.

Use this path for vendor software, offline builds, binaries, or any artifact you track without a GitHub or GitLab repository. To connect a repository instead, see Connect SCM.

Create a Generic project​

Organization admins can create a Generic project from Settings → Integrations → Generic by entering:

  • Name — The project name shown in the Platform.
  • Description — Context for the project.
  • URL — An optional external link, such as a homepage or source location.

After the project exists, you can:

  • Upload an SBOM to it from the organization SBOMs page or from the project page.
  • Create a new Generic project as part of the organization-level Upload SBOM flow.
  • Generate SBOMs with Identify tooling—including the SBOM generator CLI using this project's ID—then upload or ingest the result.
  • Review the latest uploaded SBOM on the project's SBOM, vulnerability, and license compliance pages.
  • Edit the name, description, and URL from the project Settings page.

Upload an SBOM​

Upload an SBOM when you already have a CycloneDX or SPDX document and want the Platform to inventory the components, scan for vulnerabilities, and evaluate license policy—without waiting on a connected repository workflow.

Upload from the Platform​

  1. Open SBOMs for the organization, or open a Generic project.
  2. Click Upload SBOM.
  3. Choose an existing Generic project, or create one during the upload.
  4. Select a supported SBOM file of 100 MB or smaller.
  5. Submit the upload and wait for ingest and vulnerability scanning to finish.

Supported formats​

Manual SBOM uploads accept CycloneDX JSON as well as SPDX 2.2 and 2.3 documents with the following extensions:

  • CycloneDX JSON (.json, .sbom)
  • SPDX 2.2 and 2.3 JSON (.json, .spdx.json)
  • SPDX 2.2 and 2.3 tag:value (.spdx)
  • SPDX 2.2 and 2.3 RDF/XML (.rdf, .spdx.rdf, .spdx.rdf.xml, .rdfxml, .xml)

The Platform converts SPDX 2.x uploads to CycloneDX during ingest so reports and scans use a consistent internal format. SPDX 3.0 JSON support is coming soon. Files that are not valid CycloneDX JSON or SPDX 2.x (JSON, tag:value, or RDF/XML) are rejected.

What happens after upload​

  • In-progress SBOM ingest shows a loading indicator in tables that display component counts.
  • Vulnerability scanning starts after ingest. If a scan fails, retry it from the report.

Manual uploads and manually started re-scans appear in SBOM and vulnerability views, but they do not by themselves trigger the organization vulnerability summary email.