{
  "tenant": "tenant-alpha",
  "source": "scanner.sbom.v1",
  "artifactDigest": "sha256:aaa111",
  "sbomDigest": "sha256:sbom111",
  "collectedAt": "2025-10-30T12:00:00Z",
  "eventOffset": 1182,
  "artifact": {
    "displayName": "registry.example.com/team/app:1.2.3",
    "environment": "prod",
    "labels": [
      "critical",
      "payments"
    ],
    "originRegistry": "registry.example.com",
    "supplyChainStage": "deploy"
  },
  "build": {
    "builderId": "builder://tekton/pipeline/default",
    "buildType": "https://slsa.dev/provenance/v1",
    "attestationDigest": "sha256:attestation001",
    "source": "scanner.provenance.v1",
    "collectedAt": "2025-10-30T12:00:05Z",
    "eventOffset": 2103
  },
  "components": [
    {
      "purl": "pkg:nuget/Newtonsoft.Json@13.0.3",
      "version": "13.0.3",
      "ecosystem": "nuget",
      "scope": "runtime",
      "license": {
        "spdx": "MIT",
        "name": "MIT License",
        "classification": "permissive",
        "noticeUri": "https://opensource.org/licenses/MIT",
        "sourceDigest": "sha256:ccc333"
      },
      "usage": "direct",
      "detectedBy": "sbom.analyzer.nuget",
      "layerDigest": "sha256:layer123",
      "evidenceDigest": "sha256:evidence001",
      "collectedAt": "2025-10-30T12:00:01Z",
      "eventOffset": 1183,
      "source": "scanner.sbom.v1",
      "files": [
        {
          "path": "/src/app/Program.cs",
          "contentSha256": "sha256:bbb222",
          "languageHint": "csharp",
          "sizeBytes": 3472,
          "scope": "build",
          "detectedBy": "sbom.analyzer.nuget",
          "evidenceDigest": "sha256:evidence003",
          "collectedAt": "2025-10-30T12:00:02Z",
          "eventOffset": 1185,
          "source": "scanner.layer.v1"
        }
      ],
      "dependencies": [
        {
          "purl": "pkg:nuget/System.Text.Encoding.Extensions@4.7.0",
          "version": "4.7.0",
          "relationship": "direct",
          "evidenceDigest": "sha256:evidence002",
          "collectedAt": "2025-10-30T12:00:01Z",
          "eventOffset": 1183
        }
      ]
    },
    {
      "purl": "pkg:nuget/System.Text.Encoding.Extensions@4.7.0",
      "version": "4.7.0",
      "ecosystem": "nuget",
      "scope": "runtime",
      "license": {
        "spdx": "MIT",
        "name": "MIT License",
        "classification": "permissive",
        "noticeUri": "https://opensource.org/licenses/MIT",
        "sourceDigest": "sha256:ccc333"
      },
      "usage": "transitive",
      "detectedBy": "sbom.analyzer.nuget",
      "layerDigest": "sha256:layer123",
      "evidenceDigest": "sha256:evidence001",
      "collectedAt": "2025-10-30T12:00:01Z",
      "eventOffset": 1184,
      "source": "scanner.sbom.v1",
      "files": [],
      "dependencies": []
    }
  ],
  "baseArtifacts": [
    {
      "artifactDigest": "sha256:base000",
      "sbomDigest": "sha256:sbom-base",
      "displayName": "registry.example.com/base/runtime:2025.09",
      "environment": "prod",
      "labels": [
        "base-image"
      ],
      "originRegistry": "registry.example.com",
      "supplyChainStage": "build",
      "collectedAt": "2025-10-22T08:00:00Z",
      "eventOffset": 800,
      "source": "scanner.sbom.v1"
    }
  ]
}