Software Bill of Materials
This SBOM satisfies NTIA minimum elements (supplier, component name, version, unique identifier,
dependency relationship) for the Kearney Federal Cyber Platform. Machine-readable artifacts
are linked below. Regenerate after dependency changes with
python sbom/generate-sbom.py.
Downloads
Consolidated CycloneDX (all components)
Node.js / Pulumi IaC (full tree)
Node.js / Pulumi IaC (prod only)
Python Lambda layers (summary)
First-party application components
Pulumi modules and Lambda handlers (version 1.1.0). Repository: github.com/clthomps/Kearney-Pulumi.
| Component | Description | Runtime |
|---|---|---|
kearney-soar-paas | Root Pulumi project / orchestrator | Node.js (build-time) |
ai-sandbox-platform.ts | AI Sandbox, Cognito, static site, CloudFront | Pulumi + Python 3.12 Lambda |
financial-system-log-platform.ts | SOAR log analytics product demo | Pulumi + Python 3.12 Lambda |
navy-demo-platform.ts | Navy readiness product demo | Pulumi + Python 3.12 Lambda |
tecom-demo-platform.ts | TECOM budget product demo | Pulumi + Python 3.12 Lambda |
adcd-demo-platform.ts | AD/CD honeypot detection demo | Pulumi + Python 3.12 Lambda (stdlib only) |
sandbox-security-monitoring.ts | Sandbox security monitoring stack | Pulumi |
index.py | SOAR detection pipeline | AWS Lambda Python 3.12 |
harness.py | SOAR test harness | AWS Lambda Python 3.12 |
snow_bridge.py | ServiceNow bridge | AWS Lambda Python 3.12 |
prompt_proxy.py | LLM prompt proxy (sandbox) | AWS Lambda Python 3.12 |
monitoring_embed.py | Monitoring embed helper | AWS Lambda Python 3.12 |
adcd-demo/lambda/* | Detection, honeypot, SOAR handlers | AWS Lambda Python 3.12 |
Node.js dependencies (Pulumi IaC)
Direct dependencies: @pulumi/aws, @pulumi/pulumi.
Full transitive tree: 251 packages in
cyclonedx-npm-full.json.
Python: SOAR ML Lambda layer (13 packages)
Vendored under lambda/layer/python/. Used by SOAR detection Lambdas.
| Package | Version | License | Summary |
|---|---|---|---|
| boto3 | 1.42.85 | Apache-2.0 | The AWS SDK for Python |
| botocore | 1.42.85 | Apache-2.0 | Low-level, data-driven core of boto 3. |
| jmespath | 1.1.0 | MIT | JSON Matching Expressions |
| joblib | 1.5.3 | BSD-3-Clause | Lightweight pipelining with Python functions |
| numpy | 2.4.4 | BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0 | Fundamental package for array computing in Python |
| pyarrow | 23.0.1 | Apache-2.0 | Python library for Apache Arrow |
| python-dateutil | 2.9.0.post0 | Dual License | Extensions to the standard Python datetime module |
| s3transfer | 0.16.0 | Apache License 2.0 | An Amazon S3 Transfer Manager |
| scikit-learn | 1.8.0 | BSD-3-Clause | A set of python modules for machine learning and data mining |
| scipy | 1.17.1 | Copyright (c) 2001-2002 Enthought, Inc. 2003, SciPy Developers. | Fundamental algorithms for scientific computing in Python |
| six | 1.17.0 | MIT | Python 2 and 3 compatibility utilities |
| threadpoolctl | 3.6.0 | BSD-3-Clause | threadpoolctl |
| urllib3 | 2.6.3 | MIT | HTTP library with thread-safe connection pooling, file post, and more. |
Python: TECOM/Navy shared Lambda layer (42 packages)
Packaged as tecom-demo/lambda/layer.zip. Shared by Navy and TECOM demo APIs.
| Package | Version | License | Summary |
|---|---|---|---|
| annotated-types | 0.7.0 | NOASSERTION | Reusable constraint types to use with typing.Annotated |
| anyio | 4.13.0 | MIT | High-level concurrency and networking framework on top of asyncio or Trio |
| boto3 | 1.43.13 | Apache-2.0 | The AWS SDK for Python |
| botocore | 1.43.13 | Apache-2.0 | Low-level, data-driven core of boto 3. |
| certifi | 2026.5.20 | MPL-2.0 | Python package for providing Mozilla's CA Bundle. |
| cffi | 2.0.0 | MIT | Foreign Function Interface for Python calling C code. |
| charset-normalizer | 3.4.7 | MIT | The Real First Universal Charset Detector. Open, modern and actively maintained alternative to Chardet. |
| colorama | 0.4.6 | NOASSERTION | Cross-platform colored terminal text. |
| cryptography | 48.0.0 | Apache-2.0 OR BSD-3-Clause | cryptography is a package which provides cryptographic recipes and primitives to Python developers. |
| distro | 1.9.0 | Apache License, Version 2.0 | Distro - an OS platform information API |
| google-api-core | 2.30.3 | Apache 2.0 | Google API client core library |
| google-api-python-client | 2.196.0 | Apache 2.0 | Google API Client Library for Python |
| google-auth | 2.53.0 | Apache 2.0 | Google Authentication Library |
| google-auth-httplib2 | 0.4.0 | Apache 2.0 | Google Authentication Library: httplib2 transport |
| googleapis-common-protos | 1.75.0 | Apache 2.0 | Common protobufs used in Google APIs |
| h11 | 0.16.0 | MIT | A pure-Python, bring-your-own-I/O implementation of HTTP/1.1 |
| httpcore | 1.0.9 | BSD-3-Clause | A minimal low-level HTTP client. |
| httplib2 | 0.31.2 | MIT | A comprehensive HTTP client library. |
| httpx | 0.28.1 | BSD-3-Clause | The next generation HTTP client. |
| idna | 3.16 | BSD-3-Clause | Internationalized Domain Names in Applications (IDNA) |
| jiter | 0.15.0 | MIT | Fast iterable JSON parser. |
| jmespath | 1.1.0 | MIT | JSON Matching Expressions |
| openai | 1.109.1 | Apache-2.0 | The official Python library for the openai API |
| proto-plus | 1.28.0 | Apache 2.0 | Beautiful, Pythonic protocol buffers |
| protobuf | 7.35.0 | 3-Clause BSD License | |
| pyasn1 | 0.6.3 | BSD-2-Clause | Pure-Python implementation of ASN.1 types and DER/BER/CER codecs (X.208) |
| pyasn1_modules | 0.4.2 | BSD | A collection of ASN.1-based protocols modules |
| pycparser | 3.0 | BSD-3-Clause | C parser in Python |
| pydantic | 2.13.4 | MIT | Data validation using Python type hints |
| pydantic_core | 2.46.4 | MIT | Core functionality for Pydantic validation and serialization |
| pyparsing | 3.3.2 | MIT | pyparsing - Classes and methods to define and execute parsing grammars |
| python-dateutil | 2.9.0.post0 | Dual License | Extensions to the standard Python datetime module |
| PyYAML | 6.0.3 | MIT | YAML parser and emitter for Python |
| requests | 2.34.2 | Apache-2.0 | Python HTTP for Humans. |
| s3transfer | 0.17.0 | Apache License 2.0 | An Amazon S3 Transfer Manager |
| six | 1.17.0 | MIT | Python 2 and 3 compatibility utilities |
| sniffio | 1.3.1 | MIT OR Apache-2.0 | Sniff out which async library your code is running under |
| tqdm | 4.67.3 | MPL-2.0 AND MIT | Fast, Extensible Progress Meter |
| typing-inspection | 0.4.2 | MIT | Runtime typing introspection tools |
| typing_extensions | 4.15.0 | PSF-2.0 | Backported and Experimental Type Hints for Python 3.9+ |
| uritemplate | 4.2.0 | BSD 3-Clause OR Apache-2.0 | Implementation of RFC 6570 URI Templates |
| urllib3 | 2.7.0 | MIT | HTTP library with thread-safe connection pooling, file post, and more. |
Browser runtime (CDN, not bundled)
| Component | Version | URL | Used on |
|---|---|---|---|
| mermaid | 10 | cdn.jsdelivr.net/npm/mermaid@10 | FAQ architecture diagrams |
| Google Fonts | — | fonts.googleapis.com | Static HTML pages (Merriweather, Source Sans 3, Source Code Pro) |
AWS managed runtimes (platform)
- AWS Lambda Python 3.12 — all Python handlers
- CloudFront Functions JavaScript 1.0 — SPA routing and API path rewrites
External source at deploy time
navy-demo/in this repo plus externalnavy-readiness-toolsibling checkouttecom-budget-tool
SBOM for those repos must be generated from their respective codebases.
Regeneration
npm sbom --sbom-format cyclonedx > sbom/cyclonedx-npm-full.json
npm sbom --sbom-format cyclonedx --omit dev > sbom/cyclonedx-npm-prod.json
python sbom/generate-sbom.py
python sbom/build-index.py