SBOM (Software Bill of Materials)

Inventory all software packages across your infrastructure and track known vulnerabilities (CVEs).

What is SBOM?

A Software Bill of Materials (SBOM) is an inventory of software packages, libraries, and dependencies running in your infrastructure. It tracks what's installed, what version, and where it's running.

How Moneat builds it

Moneat's SBOM feature automatically inventories software packages across your hosts and containers. The Datadog Agent scans installed packages and container images, reports them to Moneat, and the dashboard surfaces packages alongside known CVE counts so you can prioritize remediation.

Availability

SBOM inventory is included on standard plans. For self-hosted builds that use module licensing, enable the datadog module to expose the SBOM dashboard.

Prerequisites

The Datadog Agent deployed on your hosts or as a DaemonSet in Kubernetes (see Agent Setup)
For self-hosted module-licensed builds, the datadog module enabled
Container scanning requires access to the container runtime socket

Enable SBOM collection

Add SBOM configuration to your agent:

YAML

# datadog.yaml
sbom:
  enabled: true
  container_image:
    enabled: true
  host:
    enabled: true

For container image scanning, ensure the agent has access to the container runtime:

Shell

docker run -d \
 --name dd-agent \
 -e DD_DD_URL="__MONEAT_BACKEND_URL__/dd" \
 -e DD_API_KEY="YOUR_AGENT_API_KEY" \
 -v /var/run/docker.sock:/var/run/docker.sock:ro \
 -v /proc/:/host/proc/:ro \
 -v /sys/fs/cgroup/:/host/sys/fs/cgroup:ro \
  datadog/agent:latest

After adding the configuration, restart the agent:

Shell

docker restart dd-agent

Dashboard view

Navigate to Monitoring → SBOM in the dashboard to see your software inventory:

Column	Description
Package	Package or library name
Version	Installed version
Type	Package type (deb, rpm, npm, pip, go, jar, etc.)
Host	The host where the package is installed
Image	Container image name (if scanned from a container)
CVEs	Number of known vulnerabilities associated with this package version

Packages with known CVEs are highlighted so you can prioritize updates.

Use cases

Vulnerability response - When a new CVE is announced, search your SBOM to instantly see every host and container running the affected package and version
Patch prioritization - Sort by CVE count to focus on the most vulnerable packages first
Audit and compliance - Export your software inventory for security audits or compliance reporting
Drift detection - Compare package versions across hosts to identify inconsistent environments

Enable both container_image and host scanning for complete coverage. Container images often contain different packages than the host OS.