> For the complete documentation index, see [llms.txt](https://docs.interlynk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.interlynk.io/product-guides/sbom-management/doctor.md).

# SBOM Doctor

SBOM Doctor runs a suite of quality checks against an SBOM's components and flags structural problems — malformed identifiers, version mismatches, missing licenses, and unresolvable PURLs — before they affect vulnerability correlation or compliance scoring.

***

## Overview

Doctor results appear on the **Doctor** tab of any uploaded SBOM's detail page, with filters, per-component findings, and project-scoped suppressions.

Results are cached for 30 minutes and recomputed when the SBOM changes. A **force-rescan** button bypasses the cache to recompute findings immediately. Authenticated users unlock a broader set of checks that require external registry lookups.

***

## Checks

Doctor runs checks across two domains:

* **Identifier checks** — validate CPE and PURL syntax, cross-consistency between identifiers, version alignment, whether a CPE is too broad to identify the component precisely, and whether components are missing identifiers entirely.
* **License checks** — validate SPDX expression syntax and whether components have a license declared.

Authenticated users unlock an additional set of checks that perform external lookups — verifying CPEs against the NVD dictionary, resolving PURLs against package registries, and confirming license IDs are recognized SPDX identifiers.

***

## Dashboard UI

Doctor results appear on the **Doctor** tab of any SBOM's detail view.

### Viewing Results

1. Open a Product and navigate to a Version.
2. Click the **Doctor** tab on the SBOM detail page.
3. The table shows one row per finding, with columns for the affected component, version, check code, severity, domain, and a human-readable summary.

CPE and PURL identifiers in findings are click-to-copy — click an identifier to copy it to the clipboard.

### Refreshing Results

Doctor caches results for 30 minutes. To recompute findings without waiting for the cache to expire, use the **force-rescan** button (next to **Export CSV**). This bypasses the cache and re-runs the checks immediately, which is useful after correcting identifiers or re-uploading an SBOM.

### Filtering

Use the sub-header controls to narrow findings:

| Filter         | Options                               |
| -------------- | ------------------------------------- |
| **Search**     | Filter by component name              |
| **Domain**     | `identifier`, `license`               |
| **Severity**   | `critical`, `high`, `medium`, `low`   |
| **Check Code** | Filter to one or more specific checks |

Click a row to open the component drawer for full component detail and editing.

### Stats Badge

The Doctor tab label shows a badge with the count of `critical` and `high` findings for quick triage without opening the tab.

### Exporting Results

Use the **Export CSV** action in the Doctor tab's menu (next to **Refresh**) to download the findings table as a CSV file for offline review or sharing. The export dialog includes an **Apply search and filters** option (on by default) — leave it on to export only the currently filtered findings, or turn it off to export the full diagnostics table. Click **Download** to save the file.

## Suppressions

Suppress specific checks per project to avoid noise from checks that don't apply to your context — for example, suppressing `IDT-MISSING-001` for a project that intentionally ships internal-only components without PURLs.

### Configuring Suppressions

1. Navigate to the Product page.
2. Open **Settings** and select the **Doctor Checks** section.
3. Toggle any check off to suppress it for all SBOMs in this project.

Suppressed checks do not generate findings and are excluded from stats. The toggle is on by default (suppressed = off). Suppression changes are audit-logged.

### Permission

Suppression configuration requires the `edit_product_settings` permission within `view_product_group`.

***

## Common Findings and Fixes

| Finding        | What it means                                                                                              |
| -------------- | ---------------------------------------------------------------------------------------------------------- |
| `IDT-CPE-001`  | CPE is not in valid CPE 2.3 format — regenerate from your SBOM tool or correct the string                  |
| `IDT-CPE-003`  | CPE is too broad (e.g., wildcarded fields) and would match unintended components — use a more specific CPE |
| `IDT-PURL-001` | PURL is malformed — regenerate from your build tool                                                        |

For help interpreting other findings, contact <support@interlynk.io>.