Exports¶
SentriKat exports your inventory and findings in twelve formats, so auditors, customers and downstream tooling consume them natively, from Products → Exports or the REST API.
Why it matters: under the EU Cyber Resilience Act, manufacturers must draw up an SBOM from 11 December 2027, and report actively exploited vulnerabilities from 11 September 2026. SentriKat exports the SBOMs of your fleet from the Pro plan.
What your estate is made of¶
| Format | Standard | Typical consumer |
|---|---|---|
| CycloneDX 1.5 (JSON) | OWASP | SBOM tooling, customers requesting an SBOM |
| SPDX 2.3 (JSON) | Linux Foundation | legal & license review, US EO 14028 workflows |
| STIX 2.1 | OASIS CTI | threat-intel platforms, SIEM enrichment |
| Inventory CSV | n/a | a spreadsheet, when the answer is a spreadsheet |
What applies to you, for someone else's system¶
| Format | Standard | Typical consumer |
|---|---|---|
| CSAF 2.0 | OASIS | regulators & CERTs (BSI-style advisory exchange) |
| CycloneDX VEX | OWASP | tells customers which CVEs actually apply, and which are not affected |
| SARIF | OASIS | code/security platforms (GitHub Code Scanning, IDEs) |
| ServiceNow VR (JSON) | n/a | import into ITSM and vulnerability-response workflows |
| DefectDojo | n/a | import into DefectDojo |
What to do about it, for a person¶
| Format | Standard | Typical consumer |
|---|---|---|
| Remediation plan | n/a | the ordered list of updates to install |
| Device x CVE list | n/a | which machine carries which finding, one row each |
| Distro patch-list | n/a | the flat "what to patch, in what order" list for the ops team |
Consistency guarantees (what makes these trustworthy)¶
- Resolved and risk-accepted findings are excluded from remediation exports (SARIF / ServiceNow / CSAF / patch list), the exports never tell a team to fix what's already resolved or formally accepted, and they never contradict the VEX statements.
- Risk exceptions become VEX statements, with your documented justification: auditors see decisions, not gaps.
- Exports are org-scoped: each organization exports its own data only.
- Large exports come in parts, never cut in silence. Above its limit per file (5,000 results for SARIF, 20,000 findings for the other findings exports, 10,000 packages for the patch list), an export downloads in parts, the most urgent first. The Exports page fetches every part for you; each CSV part says so in its file name (
...-TRUNCATED-1-to-20000-of-21611-findings.csv). A file downloaded without asking for parts is always the whole export. Through the API, see Large findings exports come in parts.
How to export¶
- Go to Products → Exports
- Pick the format, each card states what it contains and who it's for
- Download, or call the API endpoint shown on the card from your automation (see the API reference)
Scheduled reports¶
Recurring PDF/CSV posture reports (weekly/monthly to stakeholders) are a separate feature: see Inventory → Scheduled Reports and Compliance Reports for NIS2 Article 21 and exploited-vulnerability compliance report types.