Twistlock CDX SBOM generation - components > scope field

nzw19lh — Wed, 12 Nov 2025 17:27:55 GMT

I am interesting in the SBOMs that Twistlock generates using the CDX Specification

Specifically in relation to the components > scope field

The values for scope are:

Required - the default

Optional

Excluded - where the package exists in the product (Image/Container), but is not used by the product.

Does or can Twistlock generate CDX SBOMs with the scope field defined.

As the default for scope is required, it does make it effectively optional, but for containers, I am not sure that can be the case.

Technically, everything in a product should be listed in an SBOM even if it is in a hidden layer of an image. These I would expect the scope field to be set to 'excluded'.

Hoping someone can provide some guidance.

PS if you can let me have a sample Twistlock CDX SBOM, that would be greatly appreciated!

topic Twistlock CDX SBOM generation - components > scope field in Prisma Cloud Discussions

Twistlock CDX SBOM generation - components > scope field