{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:3c3c3c3c-0000-4000-8000-000scannerout",
  "version": 1,
  "$comment": "EXAMPLE CBOM — DOES NOT CONFORM to profile pkic.example.interface-enumeration v0.1, the entry profile of the interface family. This is roughly what a scanner emits with no profile in mind: it found a TLS asset and recorded what it could see of it. The protocol and its version are there, so the two rules about the relationship itself pass. Everything that makes the record usable as an inventory entry is missing. The subject is named but carries no purl, so nothing says which version of what this describes (P3). No completeness statement, so a consumer cannot tell whether one interface is the whole list (P4). The interface is not classified, so it cannot be told from an administrative one (I7), and nothing says whether this was read from source, from a configuration or from a running system (I8). The document is valid CycloneDX throughout: every one of these failures is a profile finding, not a schema error, which is the distinction the entry profile exists to make. It is also the honest starting point for most estates — a producer at this point is not producing nothing, and the entry profile says precisely what is missing rather than rejecting the effort.",
  "metadata": {
    "timestamp": "2026-09-10T14:20:00Z",
    "component": {
      "type": "application",
      "bom-ref": "app:subject",
      "name": "example-gateway",
      "version": "4.2",
      "description": "Scanned subject. Named and versioned, but with no package identifier, so two records of it cannot be matched to each other."
    }
  },
  "components": [
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto:protocol:found-tls",
      "name": "TLS 1.3 (detected)",
      "description": "Protocol asset as a scanner recorded it: what was observed on the wire, with nothing said about what the interface is for.",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cipherSuites": [
            {
              "name": "TLS_AES_128_GCM_SHA256",
              "algorithms": [
                "crypto:algo:aes-128-gcm"
              ],
              "identifiers": [
                "0x13,0x01"
              ]
            }
          ],
          "cryptoRefArray": [
            "crypto:algo:aes-128-gcm"
          ]
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto:algo:aes-128-gcm",
      "name": "AES-128-GCM",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "ae",
          "parameterSetIdentifier": "128",
          "mode": "gcm",
          "cryptoFunctions": [
            "encrypt",
            "decrypt"
          ],
          "nistQuantumSecurityLevel": 1
        }
      }
    }
  ],
  "dependencies": [
    {
      "ref": "app:subject",
      "dependsOn": [
        "crypto:protocol:found-tls"
      ]
    },
    {
      "ref": "crypto:protocol:found-tls",
      "dependsOn": [
        "crypto:algo:aes-128-gcm"
      ]
    }
  ]
}