Project 3 / after M12

Discovery and inventory

Run discovery across network, code, certificate and dependency layers in a synthetic environment and produce a valid CycloneDX CBOM.

Deliverable: a CBOM plus an honest tooling comparison, including where the tools fail. Apply the five layers from the M12 lesson five-layer-discovery (network, code, certificate, dependency, runtime) to a synthetic environment of your choice.

How to start: using the real CycloneDX 1.7 schema fields from the M12 lesson cbom-cyclonedx (cryptoProperties, algorithmProperties, assetType), run a real scan on at least two layers (for example network and dependency) and export the result as a valid CycloneDX JSON file.

Rubric and workspace

The CBOM conforms to the CycloneDX schema (validated at build time)

At least one layer documents a specific limit of your own CLM or PKI vendor stack (a tool such as Venafi or CyberArk, or whatever tooling you use). The limit of an unrelated tool is not enough