Skip to main content

Product Overview

Sparrow SecureHub is a service for registering, signing, sharing, and reviewing SBOMs for software supply chain security. In version 2604.1, SBOMs are managed in an organization, group, and project structure.

For more information about software supply chain security, see this page.

Sparrow SecureHub Features​

🌈 Hierarchical Management
  • SBOMs are managed in a hierarchy of organizations, groups, projects, and systems.
  • You can add members at each level and assign roles for the organization, group, or project.
    • An organization is the largest unit that can be used for a company, department, or partner where users and projects are managed together.
    • A group is a unit that collects multiple projects inside an organization, such as teams, business divisions, or product lines.
    • A project is a working unit where SBOMs are registered and reviewed, and it can be organized around deliverable products, services, or solutions.
    • A system is the criterion for distinguishing SBOMs, and multiple versions of SBOM files can be registered.
🔒 Software Supply Chain Management
  • You can share SBOMs from a system or project with a specific project's users.
  • Add the suppliers that deliver to your project to the Supplier list and receive shared SBOMs through those users.
  • In the Supply Chain tab, you can review the supply chain graph that connects suppliers, systems, and consumers.
📆 SBOM Sharing History Management
  • You can review the history of SBOMs that have been shared with your project.
  • In the Received SBOM tab, you can see the sharing ID, system name, file name, sender, and sender organization.
  • In the Shared SBOM tab, you can see the recipient organization and project name.
🔎 Project-level SBOM Management
  • Projects are displayed under organizations and groups.
  • In the System tab of the project, you can register SBOMs and check the number of SBOMs, components, and vulnerabilities for each system.
💎 SBOM Integrity Proof
  • You can add a signature to an SBOM as a way to verify its integrity.
  • If you export an SBOM directly through other Sparrow products, it will be immediately signed.

Sparrow SecureHub Usage Flow​

Usage Flow​

🚩 STRUCTUREOrganization, Group, Project Creation
👤 USER SETTINGSAdd Manager, User, Supplier
  • Add managers and users for each organization, group, and project.
  • Software suppliers can be added as project suppliers.
  • For more information, see Add Members.
📦 SBOMUpload and Share SBOM
  • Separate projects by service and product units and register system SBOMs included in those services and products.
  • Upload multiple system SBOMs for a project.
  • And share uploaded SBOMs with specific projects of the consumer.
  • For more information, see Upload SBOM and Share SBOM.
📋 RESULTSCheck System Information
  • Check the system/component/vulnerability information included in the registered SBOM.
  • In the supply chain tab of the project, you can check the supply chain map that connects suppliers, your systems, and consumers in a graph.
  • For more information, see Project Information.