Twistlock CDX SBOM generation - components > scope field

[nzw19lh]

Hi

I am interesting in the SBOMs that Twistlock generates using the CDX Specification 

Specifically in relation to the components > scope field 

The values for scope are:

Required - the default

Optional

Excluded - where the package exists in the product (Image/Container), but is not used by the product.

Does or can Twistlock generate CDX SBOMs with the scope field defined. 

As the default for scope is required, it does make it effectively optional, but for containers, I am not sure that can be the case.

Technically, everything in a product should be listed in an SBOM even if it is in a hidden layer of an image. These I would expect the scope field to be set to 'excluded'.

Hoping someone can provide some guidance.

PS if you can let me have a sample Twistlock CDX SBOM, that would be greatly appreciated!