PlatformPlatform architectureProduct tourProduct graphRisk intelligenceContinuous governanceEvidence & auditDeploymentIntegrationsExecutive view
BOM SuiteSBOMCBOMQBOMAIBOMHBOMBOM Governance
SolutionsSecurityComplianceSupply chain riskQuantum readinessAI governanceDigital trust
ComplianceCERT-InRBISEBI / CSCRFMeitYNISTEU CRAEU AI ActCERT-In SBOM guide
IndustriesBanking & Financial ServicesGovernment & Public SectorDefence & Critical InfrastructureHealthcareIndian enterprises
ResourcesResource centreSBOM resourcesCBOM resourcesQBOM resourcesAIBOM resourcesHBOM resourcesProgramme & regulationBlogVulnerability disclosuresResearch
CompanyAboutSecurity & trustContact
Request a DemoTalk to an expert
DocumentationPlatform guideUpdated October 2026

Walkthroughs

Nine step-by-step tasks, from onboarding a machine to connecting a CI pipeline.

Nine task walkthroughs

Nine end-to-end tasks, each a short sequence of clicks. Use the list on the left to jump straight to the one you need; every step uses the exact labels you see in the product.

1. Onboard a machine and run its first scan

  1. Go to Assets and click Add Asset.
  2. Pick the organisation. Enter the machine name, IP address and operating system.
  3. Add SSH credentials: a username plus a password or a PEM key file. Change the SSH port if it is not 22.
  4. Choose the scan scope. Use Specific directories to limit it; otherwise the whole machine is scanned.
  5. Tick the BOM types. QBOM needs CBOM, which is ticked automatically.
  6. Click Add machine, open it, click Check connection and confirm Reachable.
  7. Click Run security scan and follow the Scans tab.
  8. When the run completes, check Overview › BOM coverage and the BOM Library tab.

2. Triage vulnerabilities and decide what to fix first

  1. Start on the Dashboard. Read the Total Vulnerabilities card and the SBOM Fix Status panel.
  2. Open Vulnerabilities › Scanned Assets and wait for the tiles to load.
  3. Note the Exploitable (EPSS ≥ 50%) and CISA KEV counts.
  4. In the CVE Inventory, set severity to Critical & High and fix status to Fix Available.
  5. Sort by EPSS or CVSS and expand a row for the Recommended Action.
  6. Check Top 10 Critical & High Vulnerable Components; one upgrade often clears many CVEs.
  7. Repeat for files from uploads and CI on Uploaded BOM/Binary/CI.

3. Investigate one component in depth

  1. Open Inventory › By Assets with the SBOM tab selected.
  2. Pick the asset, the run and the application.
  3. Filter to vulnerable components, then click Details on one.
  4. Review Security Posture, Lifecycle (EOL date) and Ownership & Licence.
  5. Read the Comments section for residual risk.
  6. To see everywhere it is used, open Inventory › By Components and search for it.

4. Check what changed between two scans

  1. In Inventory › By Assets, select an application and click BOM Drift.
  2. Review Added, Removed, Version and Licence changes, and severity counts before and after.
  3. For any two BOMs, use BOM Comparison: choose BOM A and BOM B, then Compare.

5. Assess quantum readiness and certificate risk

  1. On the Dashboard, read the QBOM band: Quantum-Vulnerable, Post-Quantum Safe and Migration Coverage.
  2. Check Expiry vs NIST Milestones for certificates valid past 2030 and past 2035.
  3. Open Inventory › By Assets › CBOM/QBOM and select a machine, run and crypto location.
  4. Review each asset's quantum readiness and score; open Details for validity, issuer and algorithms.
  5. On the asset's Cryptography tab, open Dep Graph to see how algorithms, certificates and keys connect.

6. Upload a third-party BOM or binary

  1. Go to BOM Manager and click Upload.
  2. Choose Repository for third-party software, or Machine to attach it to a registered asset.
  3. Pick the repository (or create one) and the application.
  4. Upload a BOM (CycloneDX or SPDX) or a Binary (for example a container image .tar).
  5. Check the Uploaded BOMs or Binaries tab until the status reads Analysed.
  6. Review results under Vulnerabilities and Inventory › By Assets › Uploaded BOMs.

7. Score a BOM for regulatory compliance

  1. Open BOM Inspector.
  2. Select the BOM via Asset Scan or Uploads, or upload one.
  3. Choose the framework that applies to you (for example CERT-In v2.0 for India, BSI / EU CRA for the EU).
  4. Filter findings to Failed, then Partial, and apply each fix to the BOM at its source.
  5. Click Export findings to share the gap list with the owning team.

8. Connect a CI pipeline

  1. An admin opens Settings › CI Tokens and grants token access to the pipeline owner.
  2. Generate a token: choose the user, enter the CI username exactly as the CI actor, set validity and a label.
  3. Store the token as a secret in the pipeline and configure the IntelliXBOM CLI to push BOMs.
  4. Pushed BOMs appear in BOM Manager › CI Pipeline with build ID, commit and branch.
  5. Track token expiry on the CI Tokens page and revoke unused tokens.

9. Give a teammate access

  1. Open Settings › User Profile (Access Control › Users) and click Create User.
  2. Enter username, email and name. Set a temporary password, or rely on SSO.
  3. Assign roles. Use a narrow role (for example ApplicationViewer) for read-only users.
  4. If no role fits, create one on the Roles tab, picking only the privileges needed.
See it on your own stack.Register an asset, run a scan and read your first BOM in minutes.
Request a Demo