I have a software bill of materials (SBOM) Excel file and I want to somehow track the vulnerabilities being reported for the libraries and applications in it. I know that most of SBOM tracking exists today basically integrated into the build process, but what about when we do not have a build process or only have an Excel file or let's say binary files? I can manually extract libraries list from a binary, but I have no idea if it is possible to basically give the list of software to an application and it alerts me whenever there is a CVE for the library (without integration to the build process). Is there any way to do it?
I heard about CycloneDX and SLSA framework (https://github.com/slsa-framework/slsa). But again Is it possible to do a track by inserting the software version manually? Because it seems like all existing tools are just for the build process and the only way for me is to literally join bug tracking websites mailing list and put a filter for each library that I have.
Any idea?