# SBOM Manager Advanced Search View

Use the SBOM Search to understand where components and vulnerabilities exist across your catalog of SBOMs directly from the UI. Export the results to build reports to share anywhere you need them.

## Advanced Search

Advanced Search helps you find configuration and component details through the Lifecycle, Developer, or SBOM Manager UI.

- ##### Repository Firewall

The Advanced Search does not provide results for Repository Firewall components. Use the Firewall Dashboard to search for quarantined components.

See [Firewall Dashboard](https://help.sonatype.com/en/firewall-dashboard.html "Firewall Dashboard")

To script searches for Repository Firewall, use [Firewall REST API](https://help.sonatype.com/en/firewall-apis.html "Firewall APIs").

- ##### Sonatype Lifecycle

The Advanced Search does not return policy violations. Use the Lifecycle Dashboard to search policy violations.

See [Lifecycle Dashboard](https://help.sonatype.com/en/lifecycle-dashboard.html "Lifecycle Dashboard")

To script advanced searches for Lifecycle, use [Advanced Search REST API](https://help.sonatype.com/en/advanced-search-rest-api.html "Advanced Search REST API").

Advanced Search is enabled by default, and the search index is created automatically. However, System Administrators can manually re-create the index from the _System Preferences_ menu. To do so, complete the following steps:

1. Select the_System Preferences_ icon (gear icon) from the top-navigation menu.
2. Select _Advanced Search_ from the drop-down list.
3. Ensure that the _Enabled_checkbox in the _Advanced Search Status_ field remains checked.
4. Select the _Re-Index_ button to trigger the re-index operation.

The Last Indexed date and timestamp will update when re-indexing is complete.

### Performing a Search

Advanced Search lets you build precise queries by combining multiple search terms with the supported syntax. Use Query Builder for guided rules or type directly in the search box to find organizations, applications, components, or vulnerabilities by name or ID.

The_Advanced Search_ page has two built-in ways to construct queries:

- Query Builder
- Add Search Terms

#### Query Builder

Query Builder guides you to add rules to build a query. You can add multiple rules through _Add Search Item_ and join them with AND or OR logical operators. Each rule has the following fields:

- **Select Field:** Filter by specific attributes such as Organization Name, Application Name, Application Category ID, and Component Hash.
- **Partial / Exact Match:** Specify if you would like only exact matches or to include partial matches in your results.
- **Enter Value:** Provide the string of text for which to search.

To build a query using Query Builder, take the following steps:

1. Select _Use Query Builder_ to access the _Build Query Rules_ screen.
2. Select the required attribute from the _Field_dropdown list (for example, _Organization Name, Application Name, Application Category ID, Component Hash_).
3. Select either_Partial Match_ or _Exact Match_ from the _Match Type_ dropdown list. The _Partial Match_ option wraps multi-word values in quotes and appends a wildcard.
   
   Example: typing `test`becomes` organizationName:"test"*` in the search box.

4. If you wish to add another rule, select _Add Search Item_ and repeat steps 2-3.
5. Join the rules using AND or OR logical operator.
6. Select _Search_to perform the search.

7. Review results and use _Previous_ or _Next_to move between the pages.

**Note**
- Use either Query Builder or manual editing for a single query. Combining them together can yield unexpected results.

#### Craft Your Search Terms For The Best Results

Use these tips when you write queries for Advanced Search. The Query Builder and the Add Search Terms buttons help if you prefer a guided workflow. The examples below show common queries and explain useful operators and patterns.

**Examples**

Find a specific vulnerability by its ID.

```
CVE-2019-7619
```

Search for vulnerabilities that start with a specific value. The asterisk (*) matches any number of characters.

```
CVE-2019-*
```

Search by application name. Use * as a wildcard for partial matches.

```
applicationName:nexus*
```

Search by application name and restrict results to application documents.

```
applicationName:nexus* AND itemType:APPLICATION
```

Search by application name and restrict results to security vulnerabilities.

```
applicationName:nexus* AND itemType:SECURITY_VULNERABILITY
```

Search by application name for *open* security vulnerabilities.

```
applicationName:Nexus* AND vulnerabilityStatus:Open
```

**Note**

You do not need _itemType:SECURITY_VULNERABILITY_ when you use _vulnerabilityStatus:Open_ The vulnerabilityStatus field already returns items of type _SECURITY_VULNERABILITY_.

Search specific components with a specific vulnerability state.

```
itemType:SECURITY_VULNERABILITY AND componentFormat:(a-name OR npm) AND vulnerabilityStatus:(Acknowledged OR "Not Applicable")
```

This alternative is equivalent to the example above. It shows that `OR` is optional. In this syntax the default operator between items in a parenthesis is `OR`.

```
componentFormat:(a-name npm) AND vulnerabilityStatus:(Acknowledged "Not Applicable")
```

**Tip**

Both queries above are equivalent, they return the same result. It is a good example of not actually requiring the itemType. OR is the default operator so it can be omitted.

**Important**

Also watchout for special characters that need escaping e.g.() and ""

#### Add Search Terms

Selecting the_Add Search Terms_ option opens a list of pre-formatted search query options (e.g., _applicationId_ for searching on application ID, _applicationName_ for searching on application name, etc.). Selecting a term inserts it as a properly formatted query field within the main Search box.

To use the Add Search Terms option, take the following steps:

1. Select _Add Search Terms_.
2. Select your desired search terms (e.g., _organizationId_, _applicationId_, etc.) from the list of options.
3. Properly formatted field tokens appear in the Search box as you select your desired terms. Enter values for each term after the colon to complete it.

4. A list of results displays under your query.

## Automatic Re-indexing

The Advanced Search automatically re-indexes when changes are made to the data. Automatic indexing only applies to data changes made while the feature is enabled.

## Search Performance

Advanced Search retrieves results from large data sets. To limit risk to server performance, it enforces limits to the query results. You will see an error message asking you to narrow your search with additional filters.

## Exporting Advanced Search Results

You may export search results by selecting the_Export Results_ button from the _Advanced Search_page. The search results are downloaded in a CSV file.

You can also export search results with the Advanced Search [REST API](https://help.sonatype.com/en/rest-apis.html "REST APIs").

**Advanced Search Limitations**

The Advance Search does not list all vulnerabilities known to Sonatype. The complete list of vulnerabilities are stored in Sonatype's proprietary data and is used during application analysis.

## [Reference- search item types and field names](https://help.sonatype.com/en/sbom-search.html#reference--search-item-types-and-field-names-215923_body)

Refer to the tables below for search item types and examples when building a search query.

Table 13. ORGANIZATION

| Field Name | Example |
| --- | --- |
| organizationId | organizationId:ROOT_ORGANIZATION_ID |
| organizationName | organizationName:"Root Organization" |

Table 14. APPLICATION

| Field Name | Example |
| --- | --- |
| applicationId | applicationId:22951997a36045ab8593e3b6aafb9745 |
| applicationName | applicationName:"My Application Name" |
| applicationPublicId | applicationPublicId:MyApplicationPublicId |
| applicationVersion | applicationVersion:1.0 |
| sbomSpecifications | sbomSpecifications:CycloneDx |

Table 15. APPLICATION_CATEGORY

| Field Name | Example |
| --- | --- |
| applicationCategoryId | applicationCategoryId:319cde35ef9749f4ab99a6473ad10b74 |
| applicationCategoryName | applicationCategoryName:Distributed |
| applicationCategoryColor | applicationCategoryColor:yellow |
| applicationCategoryDescription | applicationCategoryDescription:"outside the company" |

Table 16. COMPONENT

| Field Name | Example |
| --- | --- |
| componentHash | componentHash:f5149f0aaf01daf4bb2f |
| componentFormat | componentFormat:maven |
| componentName | componentName:"javax.mail : mailapi : 1.4.2" |
| componentCoordinateGroupId | componentCoordinateGroupId:commons-fileupload |
| componentCoordinateArtifactId | componentCoordinateArtifactId:mailapi |
| componentCoordinateVersion | componentCoordinateVersion:1.2.16 |
| componentCoordinateClassifier | componentCoordinateClassifier:dist |
| componentCoordinateExtension | componentCoordinateExtension:jar |
| componentCoordinateName | componentCoordinateName:"org.webjars bootstrap" |
| componentCoordinateQualifier | componentCoordinateQualifier:cp37-cp37m-win32 |
| componentCoordinatePackageId | componentCoordinatePackageId:loadash |
| componentCoordinateArchitecture | componentCoordinateArchitecture:x86_64 |
| componentCoordinatePlatform | componentCoordinatePlatform:ruby |

Table 17. COMPONENT_LABEL

| Field Name | Example |
| --- | --- |
| componentLabelId | componentLabelId:0d3f4015332e4b298ac1ed95c12ff3a3 |
| componentLabelName | componentLabelName:Architecture-Cleanup |
| componentLabelColor | componentLabelColor:orange |
| componentLabelDescription | componentLabelDescription:"relics of a build" |

Table 18. POLICY

| Field Name | Example |
| --- | --- |
| policyId | policyId:b4ca64a8b8264f03b65127016859b2a2 |
| policyName | policyName:Component-Unknown |
| policyThreatCategory | policyThreatCategory:security |
| policyThreatLevel | policyThreatLevel:10 |

Table 19. SECURITY_VULNERABILITY

| Field Name | Example |
| --- | --- |
| reportId | reportId:a6860277aa844ab5af8bfef041f7e6e5 |
| policyEvaluationStage | policyEvaluationStage:Build |
| vulnerabilityId | vulnerabilityId:CVE-2014-3625 |
| vulnerabilityStatus | vulnerabilityStatus:Open |
| vulnerabilitySeverity | vulnerabilitySeverity:7.1 |
| vulnerabilityDescription | vulnerabilityDescription:"directory traversal" |

Table 20. POLICY_VIOLATION

| Field Name | Example |
| --- | --- |
| policyViolationPolicyName | policyViolationPolicyName:Security-High |
| policyViolationPolicyId | policyViolationPolicyId:12345 |
| policyViolationThreatCategory | policyViolationThreatCategory:Security |
| policyViolationThreatLevel | policyViolationThreatLevel:[7 TO 10] |
| policyViolationWaiverStatus | policyViolationWaiverStatus:Active |
| policyViolationConstraintName | policyViolationConstraintName:"License Threat Group" |

Table 21. LICENSE

| Field Name | Example |
| --- | --- |
| componentEffectiveLicenseId | componentEffectiveLicenseId:Apache-2.0 |
| componentEffectiveLicenseName | componentEffectiveLicenseName:"Apache License 2.0" |
| componentLicenseThreatGroupName | componentLicenseThreatGroupName:Copyleft |
| componentLicenseThreatLevel | componentLicenseThreatLevel:[7 TO 10] |

## Search results

No results found.