--- description: "The Fluid Attacks platform has detailed information about the attack surface of your software, showing the status of assets and allowing you to generate SBOMs." keywords: "SBOM, software bill of materials, attack surface, ports, lines, Git roots, languages, Fluid Attacks platform, Fluid Attacks documentation" other: private: false title: See the target of evaluation's status and SBOM --- # See the target of evaluation's status and SBOM import { Image } from "@/components/image"; Fluid Attacks' platform allows you to identify the statuses of your group's assets in the **Inventory** section. Notably, within it, there is a **[Packages](https://help.fluidattacks.com/portal/en/kb/articles/analyze-your-supply-chain-security)** section that informs you of the security of third-party components and lets you generate a software bill of materials (SBOM). View Packages section on the Fluid Attacks platform

View Packages section on the Fluid Attacks platform

Then there is the **Surface** section, which provides a comprehensive overview of the [target of evaluation (ToE)](https://help.fluidattacks.com/portal/en/kb/articles/glossary#Target_of_Evaluation_ToE), which refers to a specific [part of a system or product](https://csrc.nist.gov/glossary/term/target_of_evaluation) being tested for security vulnerabilities. It defines the boundary within which the evaluation is conducted. On Fluid Attacks' platform, the ToE is dynamically generated based on the repositories and environments defined by your team in the [Scope section](https://help.fluidattacks.com/portal/en/kb/articles/manage-roots). The **Surface** section is further organized into four distinct sections. Inspect the target of evaluation on the Fluid Attacks platform

Inspect the target of evaluation on the Fluid Attacks platform

The following are, in short, the assets and components of your ToE that **Inventory** displays: 1. **[Packages](https://help.fluidattacks.com/portal/en/kb/articles/see-the-target-of-evaluation-status-and-sbom#Packages):** The third-party components on which your software depends 1. **[Languages](https://help.fluidattacks.com/portal/en/kb/articles/see-the-target-of-evaluation-status-and-sbom#Languages):** The different programming languages utilized within your codebase 1. **[Lines](https://help.fluidattacks.com/portal/en/kb/articles/see-the-target-of-evaluation-status-and-sbom#Lines):** The code files present in the [added Git repositories](https://help.fluidattacks.com/portal/en/kb/articles/manage-roots#Manage_Git_Roots) 1. **[Inputs](https://help.fluidattacks.com/portal/en/kb/articles/see-the-target-of-evaluation-status-and-sbom#Inputs):** The [environments](https://help.fluidattacks.com/portal/en/kb/articles/manage-roots#Manage_Environments) designated for testing, such as URLs/IPs 1. **[Ports](https://help.fluidattacks.com/portal/en/kb/articles/see-the-target-of-evaluation-status-and-sbom#Ports):** The ports associated with the [IP addresses](https://help.fluidattacks.com/portal/en/kb/articles/manage-roots#Manage_IP_Roots) to test ## Packages A package ToE represents a third-party component on which the application depends. The **Packages** section of Inventory allows you to pinpoint your usage of these components within your software and identify those with reachable security weaknesses. Detailed information about this section is available in [Analyze your supply chain security](https://help.fluidattacks.com/portal/en/kb/articles/analyze-your-supply-chain-security). View packages security status on the Fluid Attacks platform

View packages security status on the Fluid Attacks platform

## Languages This section of Surface shows the programming languages used in your repositories added in Scope. To know which languages are supported by Fluid Attacks' vulnerability scanning, read the page [Supported languages](https://help.fluidattacks.com/portal/en/kb/articles/supported-languages). Bear in mind that Advanced plan users benefit from greater programming language support, as the team of pentesters covers languages that the scanner does not support. Know languages used in source code on the Fluid Attacks platform

Know languages used in source code on the Fluid Attacks platform

The Languages section shows a table providing the following information: - **Language:** The specific programming language detected in your source code - **Lines of code:** Total lines of code written in the language in question - **Percentage:** The percentage of usage of the language throughout the project ## Lines A line ToE represents a file in the source code that is analyzed from active roots registered in [Git Repositories](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Manage_Git_repositories). These ToEs are automatically created and updated based on cloning results. A new line ToE is generated whenever a new file is added, and it is updated when the file length changes or the file is removed. Further, line ToEs persist even if their associated root is deactivated. The **Lines** section on the platform breaks down the root directories and the files within them, representing the part of the ToE that is source code. The latter is evaluated by Fluid Attacks with methodologies such as [static application security testing](https://help.fluidattacks.com/portal/en/kb/articles/what-is-sast) (SAST) and [secure code review](https://fluidattacks.com/solutions/secure-code-review/). View code files security status on the Fluid Attacks platform

View code files security status on the Fluid Attacks platform

**Lines** shows a table providing the following information (to show or hide table columns, use the **Columns** filter (

)): - **Repository:** Name of the code repository that was added in [Git Repositories](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Manage_Git_repositories) - **Filename:** Path of the file within the code repository - **LOC:** Total number of LOC (lines of code) in the file - **Status:** Indicates whether the file is vulnerable or safe - **Modified date:** The last time the file was modified - **Last commit:** The most recent commit identified modifying the file - **Last author:** The last [author](https://help.fluidattacks.com/portal/en/kb/articles/invite-contributing-developers) who modified the file - **Seen at:** The date the file was added to the ToE - **In tests:** Confirms if the file exists in an active repository (i.e., included in tests) - **Sorts Priority Factor:** A column shown to Fluid Attacks staff only, it shows the [probability of a file containing vulnerabilities](https://help.fluidattacks.com/portal/en/kb/articles/introduction-to-fluid-attacks-ai-tool) on the basis of a machine learning model Several filters are available in the Lines section to help you find information quickly. Access these filters by clicking on the filters button (

Filter lines table on the Fluid Attacks platform

View filters in **Lines** Apply filter in Lines on the Fluid Attacks platform

Apply filter in **Lines** Next to the button you can see the number of filters that have been applied, if any, while the specific filters are displayed above the table. To clear filters, simply click on the X button next to them. Clear filters in Lines section on the Fluid Attacks platform

Clear filters in Lines section on the Fluid Attacks platform

## Inputs An input ToE represents any accessible resource from an analyzed environment. It has a component (URI) and one entry point (access identifier or hint) to describe a target of evaluation. Input ToEs must be added or modified manually by Fluid Attacks' security analysts but are removed automatically if they are associated with inactive roots and no vulnerabilities are linked to the ToE. The **Inputs** section on the platform displays the [environments](https://help.fluidattacks.com/portal/en/kb/articles/manage-roots#Manage_Environments) specified in the Scope section along with the application's entry points that are under evaluation with techniques such as [dynamic application security testing](https://help.fluidattacks.com/portal/en/kb/articles/what-is-dast) (DAST) and, exclusively for the [Advanced](https://help.fluidattacks.com/portal/en/kb/articles/continuous-hacking-free-trial-plans-and-pricing#Continuous_Hacking_plans) plan, [penetration testing as a service](https://fluidattacks.com/solutions/penetration-testing-as-a-service/) (PTaaS). View inputs security status on the Fluid Attacks platform

View inputs security status on the Fluid Attacks platform

The Inputs section shows a table providing the following information (to show or hide table columns, use the **Columns** filter (

)): - **Repository:** Name of the code repository to which the environment is associated, as specified in the [Scope](https://help.fluidattacks.com/portal/en/kb/articles/manage-roots#Manage_Environments) section - **Entry point:** Specific input field within the component - **Status:** Indicates whether the component is vulnerable or safe - **Seen at:** The date the component was added - **Component:** The URLs/IPs associated with the environment - **In tests:** Confirms if the file or document exists in the repository Various filter options are available in the Inputs section. Click on the filters button (

) to access these options. (Read the [instructions to clear filters](https://help.fluidattacks.com/portal/en/kb/articles/see-the-target-of-evaluation-status-and-sbom#Lines) above on this page.) Filter inputs table on the Fluid Attacks platform

Filter inputs table on the Fluid Attacks platform

## Ports A port ToE represents a valid port (0-65595) where the application is ready to be tested. It has an IP root and the port. IP roots and port TOEs manually are added or modified manually and are currently not removed. The **Ports** section of Inventory displays the ports associated with your [IP address](https://help.fluidattacks.com/portal/en/kb/articles/manage-roots#Manage_IP_Roots). This section will only contain content if your group's Service is classified as [Black](https://help.fluidattacks.com/portal/en/kb/articles/manage-a-group-s-configuration#Manage_group_services) (meaning that only [black-box testing](https://help.fluidattacks.com/portal/en/kb/articles/glossary#Black_box) is performed). View ports security status on the Fluid Attacks platform

View ports security status on the Fluid Attacks platform

The Ports section shows a table providing the following information (to show or hide table columns, use the **Columns** filter (

)): - **Repository:** The nickname your organization has given the IP root added in the [Scope section](https://help.fluidattacks.com/portal/en/kb/articles/manage-roots#Add_an_IP_root) - **Address:** The IP address - **Port:** The port that is under evaluation - **Status:** Indicates whether the port is safe or vulnerable - **Seen at:** The date the port was added - **Be present:** Confirms if the IP address is present Several filters are available in the Ports section. Access these filters by clicking on the filters button (

). (Read the [instructions to clear filters](https://help.fluidattacks.com/portal/en/kb/articles/see-the-target-of-evaluation-status-and-sbom#Lines) above on this page.) Filter ports table on the Fluid Attacks platform

Filter ports table on the Fluid Attacks platform

## Export to CSV The [Languages](https://help.fluidattacks.com/portal/en/kb/articles/see-the-target-of-evaluation-status-and-sbom#Languages), [Lines](https://help.fluidattacks.com/portal/en/kb/articles/see-the-target-of-evaluation-status-and-sbom#Lines), [Inputs](https://help.fluidattacks.com/portal/en/kb/articles/see-the-target-of-evaluation-status-and-sbom#Inputs) and [Ports](https://help.fluidattacks.com/portal/en/kb/articles/see-the-target-of-evaluation-status-and-sbom#Ports) sections have an **Export** button that allows you to download the information in the section in comma-separated values (CSV) format. ## Export SBOM Application security extends beyond proprietary code, as your development project's security depends on that of your software supply chains. Fluid Attacks' platform offers a **Packages** section within Inventory, where you can keep track of your software's dependencies, specially, their security status. Further, you can download a [software bill of materials](https://help.fluidattacks.com/portal/en/kb/articles/glossary#Software_bill_of_materials_SBOM) (SBOM). This document, available in the CycloneDX and SPDX formats, provides you with a useful, standardized inventory. In **Packages**, click on **Export SBOM** and follow the prompts. For details, read [Analyze your supply chain security](https://help.fluidattacks.com/portal/en/kb/articles/analyze-your-supply-chain-security#Export_SBOM). > [!TIP] > > **Free trial** > Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your [21-day free trial](https://app.fluidattacks.com/SignUp) and discover the benefits of the [Continuous Hacking](https://fluidattacks.com/services/continuous-hacking/) [Essential plan](https://fluidattacks.com/plans/). If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out [this contact form](https://fluidattacks.com/contact-us/).