Server SBOM and Application SBOM

FutureVuls provides two methods for managing SBOMs: Server SBOM and Application SBOM.

Server SBOM

SBOMs registered via "Import SBOM" under Server / Product > Add Server are called Server SBOMs. This process creates a single "server" that includes OS information and OS packages, and only one Server SBOM can be registered per server.

A scan is automatically performed upon upload, and you can check the results in Group Settings > Scan History.

Application SBOM

This method adds application dependencies (an SBOM) to an existing server, registering language libraries and other components. You can add SBOM files from the "Server / Product" tab > "Server Details", and multiple Application SBOMs can be registered per server.

A scan is not automatically performed upon upload, so if you want to detect vulnerabilities immediately, run a manual scan separately.

Summary

Item	Server SBOM	Application SBOM
Registration Method	・Server / Product tab → Add Server → Import SBOM ・A new server is created upon upload.	・For an existing server, go to the Details screen → "SBOM Files" section → Add button.
Information Used for Scanning	・OS information (OS name, version) ・OS packages ・Language libraries	・OS information and OS packages are not used ・Language libraries
Initial Scan Timing	A scan runs automatically right after registration. *A separate manual scan is required when registering via file upload.	Manual scan or scheduled scan.
Display on Server Details Screen	The SBOM file, with the same name as the server, is registered in the server details, and "(Server)" is displayed after the name.	Each uploaded SBOM file is added to the server details, and a server can hold multiple Application SBOMs.
Registration Limit	Only one Server SBOM can be registered per server.	Multiple Application SBOMs can be registered per server.
Deletion Method	When the server is deleted, its Server SBOM is also deleted.	Each SBOM can be deleted individually using its Delete button.