Do not reparse every stored SBOM when an advisory lands. Index components once, then match each new advisory against that index and open findings for the products that contain affected versions. Reparse only when your matching rules change or when a file is revised.
Why reparsing does not scale
An organization with many suppliers and many releases may hold thousands of files. Parsing them all on each advisory wastes time, and advisories arrive constantly. The matching question is small: does this package and version range intersect the component index? A database query answers that.
The event driven design
- Ingest the advisory feed. Pull from the sources you trust and normalize each record. The OSV schema gives you a common shape with package, ecosystem, ranges and an explicit versions list, plus aliases to link other IDs.
- Detect changes. The OSV schema requires a modified timestamp, and when two entries share an ID the later modified time is authoritative. Use it to process only new or updated records.
- Query the component index. Select components whose ecosystem and name equal the advisory package and whose version falls in any range or list.
- Create findings. One per component instance, linked to product, release and supplier.
- Enrich. Add exploitation evidence, for example whether the CVE is in CISA's KEV catalog, and any supplier statements.
- Notify. Send owners the findings relevant to them, not the whole feed.
- Track resolution. Update findings when a fix is confirmed or a supplier statement arrives.
When you should reparse
- The supplier sends a revision.
- You change normalization, for example how you handle purl qualifiers.
- You add a new matching source.
- A bug in your parser is fixed.
Edge cases
| Case | Handling |
|---|---|
| Advisory withdrawn | Close findings, record reason |
| Advisory range updated | Rematch, the set may grow or shrink |
| Component with no identifier | Never matches, list under data gaps |
| Several aliases | Deduplicate to a single finding |
Measure it
Track the time from advisory publication to your first finding. That number tells you how well the pipeline works, and it is easy to explain to leadership.
Try it yourself
Click through it at your own pace, or open it full screen.
Follow how a new advisory is linked to the components that are exposed.
Where Safeguard fits
Safeguard provides zero-day discovery and continuous monitoring on top of SBOM and dependency scanning. Run a free scan to build an inventory first.
Quick check
Do I need to reparse files each night?
No. Query the index. Reparse only when rules change or a file is revised.
How do I avoid duplicate findings across advisories?
Use aliases to merge records that describe the same issue.
Sources
- OSV schema: modified, aliases, ranges and versions.
- CISA KEV catalog: exploitation evidence source.
Last reviewed: 19 October 2026.
