AccuKnox xBOM Scan

Generate a CycloneDX Bill of Materials from your Azure Pipeline and upload it to the AccuKnox Console.

One task covers three BOM types — pick what you need with the BOM Type input.

Features

Three BOM types, one task – SBOM (packages and dependencies), CBOM (cryptographic assets) and AIBOM (AI/ML model inventory).
Scan a path or an image – Point SBOM and CBOM at a source tree or at a container image built earlier in the same job.
AI model inventory – Generate an AIBOM from a HuggingFace model or from every foundation model in an AWS Bedrock region.
CycloneDX 1.6 – Standard, portable output.
Uploaded and archived – Results land in the AccuKnox Console and the BOM is attached to the pipeline run as a downloadable artifact.

Runs on Linux, macOS and Windows agents (amd64 or arm64; Windows is amd64 only). The task downloads the CLI build matching the agent automatically.

Setup

Store the credentials as secret pipeline variables: ACCUKNOX_ENDPOINT, ACCUKNOX_TOKEN, ACCUKNOX_LABEL.

Then create a Project in the AccuKnox Console under SBOM → Projects. The projectName and projectClassifier inputs must exactly match that Project.

Inputs

Name	Description	Required
`bomType`	`sbom`, `cbom` or `aibom`	Yes
`accuknoxEndpoint`	AccuKnox hostname, no `https://`	Yes
`accuknoxToken`	AccuKnox API token	Yes
`accuknoxLabel`	AccuKnox label	Yes
`projectName`	Project name, as created in the Console	Yes
`projectClassifier`	`application`, `container`, `firmware`, `library` or `machine-learning-model`	Yes
`scanPath`	Directory to scan (SBOM/CBOM)	No (default: `.`)
`imageRef`	Container image to scan; takes precedence over `scanPath`	No
`aibomSource`	`huggingface` or `bedrock`	No (default: `huggingface`)
`aibomModel`	HuggingFace model ID	Only for `huggingface`
`awsRegion`, `awsAccessKeyId`, `awsSecretAccessKey`	AWS credentials for the Bedrock inventory	Only for `bedrock`
`outputFile`	Where to write the BOM	No
`knoxctlVersion`	CLI release tag	No (default: `v0.10.0`)
`skipTlsVerify`	Disable TLS verification on upload	No (default: `false`)

All examples assume the credentials are defined as pipeline variables: ACCUKNOX_ENDPOINT, ACCUKNOX_TOKEN, ACCUKNOX_LABEL.

1. SBOM from a filesystem

- task: AccuKnox-xBOM@2
  inputs:
    bomType: sbom
    scanPath: '.'
    accuknoxEndpoint: $(ACCUKNOX_ENDPOINT)
    accuknoxToken: $(ACCUKNOX_TOKEN)
    accuknoxLabel: $(ACCUKNOX_LABEL)
    projectName: my-project
    projectClassifier: application

2. SBOM from a container image

- script: |
    IMAGE="myapp:$(Build.SourceVersion)"
    docker build -t "$IMAGE" .
    echo "##vso[task.setvariable variable=IMAGE]$IMAGE"
  displayName: Build image

- task: AccuKnox-xBOM@2
  inputs:
    bomType: sbom
    imageRef: $(IMAGE)
    accuknoxEndpoint: $(ACCUKNOX_ENDPOINT)
    accuknoxToken: $(ACCUKNOX_TOKEN)
    accuknoxLabel: $(ACCUKNOX_LABEL)
    projectName: my-project
    projectClassifier: container

3. CBOM from Go source

- task: AccuKnox-xBOM@2
  inputs:
    bomType: cbom
    scanPath: '.'
    accuknoxEndpoint: $(ACCUKNOX_ENDPOINT)
    accuknoxToken: $(ACCUKNOX_TOKEN)
    accuknoxLabel: $(ACCUKNOX_LABEL)
    projectName: my-project
    projectClassifier: application

4. CBOM from a container image

- task: AccuKnox-xBOM@2
  inputs:
    bomType: cbom
    imageRef: $(IMAGE)
    accuknoxEndpoint: $(ACCUKNOX_ENDPOINT)
    accuknoxToken: $(ACCUKNOX_TOKEN)
    accuknoxLabel: $(ACCUKNOX_LABEL)
    projectName: my-project
    projectClassifier: container

5. AIBOM from a HuggingFace model

- task: AccuKnox-xBOM@2
  inputs:
    bomType: aibom
    aibomSource: huggingface
    aibomModel: google-bert/bert-base-uncased
    accuknoxEndpoint: $(ACCUKNOX_ENDPOINT)
    accuknoxToken: $(ACCUKNOX_TOKEN)
    accuknoxLabel: $(ACCUKNOX_LABEL)
    projectName: my-project
    projectClassifier: machine-learning-model

6. AIBOM from AWS Bedrock

- task: AccuKnox-xBOM@2
  inputs:
    bomType: aibom
    aibomSource: bedrock
    awsRegion: us-east-1
    awsAccessKeyId: $(AWS_ACCESS_KEY_ID)
    awsSecretAccessKey: $(AWS_SECRET_ACCESS_KEY)
    accuknoxEndpoint: $(ACCUKNOX_ENDPOINT)
    accuknoxToken: $(ACCUKNOX_TOKEN)
    accuknoxLabel: $(ACCUKNOX_LABEL)
    projectName: my-project
    projectClassifier: machine-learning-model

Downloading the BOM

The BOM is attached to the pipeline run as an artifact named <bomType>-<buildId>. Open the run and use Related → Published artifacts to download it.

Results

Findings are available in the AccuKnox Console under SBOM → Projects, filtered by the project you configured.