@cyclonedx/cdxgen/data/rules/hbom-performance.yaml

Creates CycloneDX Software Bill of Materials (SBOM) from source or container image

# HBOM Performance Rules
# Category: hbom-performance
# Evaluates hardware inventory for storage, thermal, battery, network, and memory degradation signals.

- id: HBP-001
  name: "Storage volume has low free capacity headroom"
  description: "Low free storage headroom can degrade builds, patching, logging, indexing, and general host responsiveness."
  severity: medium
  category: hbom-performance
  dry-run-support: full
  condition: |
    components[
      $prop($, 'cdx:hbom:hardwareClass') = 'storage-volume'
      and $hasProp($, 'cdx:hbom:capacityBytes')
      and $hasProp($, 'cdx:hbom:freeBytes')
      and $number($prop($, 'cdx:hbom:capacityBytes')) > 0
      and ($number($prop($, 'cdx:hbom:freeBytes')) / $number($prop($, 'cdx:hbom:capacityBytes'))) < 0.15
    ]
  location: |
    {
      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
    }
  message: "Storage volume '{{ name }}' has less than 15% free capacity remaining"
  mitigation: "Free local capacity, move caches or logs off the volume, or expand storage before performance and maintenance tasks degrade further."
  evidence: |
    {
      "capacityBytes": $prop($, 'cdx:hbom:capacityBytes'),
      "freeBytes": $prop($, 'cdx:hbom:freeBytes'),
      "sizeBytes": $prop($, 'cdx:hbom:sizeBytes'),
      "volumeUuid": $prop($, 'cdx:hbom:volumeUuid')
    }

- id: HBP-002
  name: "Storage health is degraded or wear is near exhaustion"
  description: "Degraded SMART state or high wear percentage is a strong leading indicator of latency, failure, or replacement pressure."
  severity: high
  category: hbom-performance
  dry-run-support: full
  condition: |
    components[
      (
        $prop($, 'cdx:hbom:hardwareClass') = 'storage'
        or $prop($, 'cdx:hbom:hardwareClass') = 'storage-device'
        or $prop($, 'cdx:hbom:hardwareClass') = 'storage-volume'
      )
      and (
        (
          $hasProp($, 'cdx:hbom:smartStatus')
          and $lowercase($safeStr($prop($, 'cdx:hbom:smartStatus'))) != 'verified'
          and $lowercase($safeStr($prop($, 'cdx:hbom:smartStatus'))) != 'ok'
          and $lowercase($safeStr($prop($, 'cdx:hbom:smartStatus'))) != 'passed'
        )
        or (
          $hasProp($, 'cdx:hbom:wearPercentageUsed')
          and $number($prop($, 'cdx:hbom:wearPercentageUsed')) >= 80
        )
      )
    ]
  location: |
    {
      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
    }
  message: "Storage component '{{ name }}' shows degraded health or high wear"
  mitigation: "Review SMART telemetry, schedule replacement for worn media, and move latency-sensitive workloads off the affected device."
  evidence: |
    {
      "smartStatus": $prop($, 'cdx:hbom:smartStatus'),
      "wearPercentageUsed": $prop($, 'cdx:hbom:wearPercentageUsed'),
      "revision": $prop($, 'cdx:hbom:revision'),
      "deviceSerial": $prop($, 'cdx:hbom:deviceSerial')
    }

- id: HBP-003
  name: "Thermal zone reports sustained high temperature"
  description: "High thermal-zone temperatures can trigger throttling, instability, and accelerated hardware wear."
  severity: high
  category: hbom-performance
  dry-run-support: full
  condition: |
    components[
      (
        $prop($, 'cdx:hbom:hardwareClass') = 'thermal-zone'
        or $prop($, 'cdx:hbom:hardwareClass') = 'sensor'
      )
      and $hasProp($, 'cdx:hbom:temperatureCelsius')
      and $number($prop($, 'cdx:hbom:temperatureCelsius')) >= 85
    ]
  location: |
    {
      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
    }
  message: "Thermal component '{{ name }}' reports high temperature '{{ $prop($, 'cdx:hbom:temperatureCelsius') }}°C'"
  mitigation: "Inspect cooling, fan policy, dust buildup, and workload placement before the host begins sustained throttling or thermal shutdown behavior."
  evidence: |
    {
      "temperatureCelsius": $prop($, 'cdx:hbom:temperatureCelsius'),
      "temperatureReadings": $prop($, 'cdx:hbom:temperatureReadings'),
      "fanCount": $prop($, 'cdx:hbom:fanCount'),
      "fanReadings": $prop($, 'cdx:hbom:fanReadings')
    }

- id: HBP-004
  name: "Battery health is degraded"
  description: "Battery packs with low maximum capacity, poor health, or extreme cycle counts can materially degrade mobile system performance and runtime."
  severity: medium
  category: hbom-performance
  dry-run-support: full
  condition: |
    components[
      $prop($, 'cdx:hbom:hardwareClass') = 'power'
      and (
        (
          $hasProp($, 'cdx:hbom:maximumCapacity')
          and $number($substringBefore($prop($, 'cdx:hbom:maximumCapacity'), '%')) < 80
        )
        or (
          $hasProp($, 'cdx:hbom:health')
          and $not($lowercase($safeStr($prop($, 'cdx:hbom:health'))) = 'good')
        )
        or (
          $hasProp($, 'cdx:hbom:cycleCount')
          and $number($prop($, 'cdx:hbom:cycleCount')) >= 1000
        )
      )
    ]
  location: |
    {
      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
    }
  message: "Battery component '{{ name }}' shows degraded health or elevated lifecycle wear"
  mitigation: "Recalibrate or replace the battery, verify charging policy, and keep performance-sensitive mobile workloads off batteries nearing replacement thresholds."
  evidence: |
    {
      "maximumCapacity": $prop($, 'cdx:hbom:maximumCapacity'),
      "health": $prop($, 'cdx:hbom:health'),
      "cycleCount": $prop($, 'cdx:hbom:cycleCount'),
      "chargePercent": $prop($, 'cdx:hbom:chargePercent')
    }

- id: HBP-005
  name: "Active wired link is operating below expected duplex or bandwidth"
  description: "Half-duplex or very low negotiated wired-link speed often correlates with cable, switch, or interface misconfiguration that hurts throughput and latency."
  severity: medium
  category: hbom-performance
  dry-run-support: full
  condition: |
    components[
      $prop($, 'cdx:hbom:hardwareClass') = 'network-interface'
      and (
        $lowercase($safeStr($prop($, 'cdx:hbom:status'))) = 'active'
        or $lowercase($safeStr($prop($, 'cdx:hbom:operState'))) = 'up'
      )
      and (
        $lowercase($safeStr($prop($, 'cdx:hbom:duplex'))) = 'half'
        or (
          $hasProp($, 'cdx:hbom:speedMbps')
          and $number($prop($, 'cdx:hbom:speedMbps')) > 0
          and $number($prop($, 'cdx:hbom:speedMbps')) < 1000
        )
      )
    ]
  location: |
    {
      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
    }
  message: "Active wired interface '{{ name }}' is operating with degraded duplex or bandwidth characteristics"
  mitigation: "Check cabling, switch configuration, NIC driver/firmware, and negotiated link settings before treating application latency as purely software-related."
  evidence: |
    {
      "duplex": $prop($, 'cdx:hbom:duplex'),
      "speedMbps": $prop($, 'cdx:hbom:speedMbps'),
      "status": $prop($, 'cdx:hbom:status'),
      "operState": $prop($, 'cdx:hbom:operState'),
      "driver": $prop($, 'cdx:hbom:driver')
    }

- id: HBP-006
  name: "Installed memory is only partially online"
  description: "A significant gap between installed and online memory suggests capacity loss, firmware drift, or topology issues that can affect performance-critical workloads."
  severity: high
  category: hbom-performance
  dry-run-support: full
  condition: |
    components[
      $prop($, 'cdx:hbom:hardwareClass') = 'memory'
      and $hasProp($, 'cdx:hbom:sizeBytes')
      and $hasProp($, 'cdx:hbom:memoryOnlineSize')
      and $number($prop($, 'cdx:hbom:sizeBytes')) > 0
      and $parseSizeBytes($prop($, 'cdx:hbom:memoryOnlineSize')) != null
      and ($parseSizeBytes($prop($, 'cdx:hbom:memoryOnlineSize')) / $number($prop($, 'cdx:hbom:sizeBytes'))) < 0.9
    ]
  location: |
    {
      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
    }
  message: "Memory component '{{ name }}' reports materially less online capacity than installed capacity"
  mitigation: "Review DIMM population, firmware, NUMA/memory-hotplug settings, and kernel memory-online state before scaling workloads on the host."
  evidence: |
    {
      "sizeBytes": $prop($, 'cdx:hbom:sizeBytes'),
      "memoryOnlineSize": $prop($, 'cdx:hbom:memoryOnlineSize'),
      "memoryRangeCount": $prop($, 'cdx:hbom:memoryRangeCount'),
      "addressSizes": $prop($, 'cdx:hbom:addressSizes')
    }

- id: HBP-007
  name: "Battery design capacity has materially degraded"
  description: "Detailed Linux battery telemetry can reveal packs whose full-charge capacity has fallen materially below their design baseline, reducing runtime and stability under load."
  severity: medium
  category: hbom-performance
  dry-run-support: full
  condition: |
    components[
      $prop($, 'cdx:hbom:hardwareClass') = 'power'
      and (
        (
          $hasProp($, 'cdx:hbom:designCapacityPercent')
          and $number($prop($, 'cdx:hbom:designCapacityPercent')) > 0
          and $number($prop($, 'cdx:hbom:designCapacityPercent')) < 80
        )
        or (
          $hasProp($, 'cdx:hbom:energyFull')
          and $hasProp($, 'cdx:hbom:energyFullDesign')
          and $number($prop($, 'cdx:hbom:energyFullDesign')) > 0
          and ($number($prop($, 'cdx:hbom:energyFull')) / $number($prop($, 'cdx:hbom:energyFullDesign'))) < 0.8
        )
        or (
          $hasProp($, 'cdx:hbom:chargeFull')
          and $hasProp($, 'cdx:hbom:chargeFullDesign')
          and $number($prop($, 'cdx:hbom:chargeFullDesign')) > 0
          and ($number($prop($, 'cdx:hbom:chargeFull')) / $number($prop($, 'cdx:hbom:chargeFullDesign'))) < 0.8
        )
      )
    ]
  location: |
    {
      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
    }
  message: "Battery component '{{ name }}' has materially degraded relative to its design capacity"
  mitigation: "Plan battery replacement or recalibration, review charging policy, and keep performance-sensitive mobile workloads away from hosts with heavily degraded packs."
  evidence: |
    {
      "designCapacityPercent": $prop($, 'cdx:hbom:designCapacityPercent'),
      "energyFull": $prop($, 'cdx:hbom:energyFull'),
      "energyFullDesign": $prop($, 'cdx:hbom:energyFullDesign'),
      "chargeFull": $prop($, 'cdx:hbom:chargeFull'),
      "chargeFullDesign": $prop($, 'cdx:hbom:chargeFullDesign'),
      "warningLevel": $prop($, 'cdx:hbom:warningLevel')
    }

- id: HBP-008
  name: "USB device requires more current than the bus reports available"
  description: "A USB device that requires more current than the bus exposes as available can behave unreliably, disconnect under load, or trigger peripheral instability."
  severity: medium
  category: hbom-performance
  dry-run-support: full
  condition: |
    components[
      $prop($, 'cdx:hbom:hardwareClass') = 'usb-device'
      and $hasProp($, 'cdx:hbom:currentRequired')
      and $hasProp($, 'cdx:hbom:currentAvailable')
      and $number($prop($, 'cdx:hbom:currentRequired')) > $number($prop($, 'cdx:hbom:currentAvailable'))
    ]
  location: |
    {
      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
    }
  message: "USB component '{{ name }}' reports higher current demand than the bus currently provides"
  mitigation: "Move the device to a powered hub or higher-capacity port, reduce competing bus load, and verify peripheral power expectations before troubleshooting higher-layer software issues."
  evidence: |
    {
      "currentRequired": $prop($, 'cdx:hbom:currentRequired'),
      "currentAvailable": $prop($, 'cdx:hbom:currentAvailable'),
      "maxPowerMilliAmps": $prop($, 'cdx:hbom:maxPowerMilliAmps'),
      "selfPowered": $prop($, 'cdx:hbom:selfPowered'),
      "remoteWakeup": $prop($, 'cdx:hbom:remoteWakeup')
    }

- id: HBP-009
  name: "Cellular modem reports weak signal quality"
  description: "A modem with very weak reported signal quality can cause intermittent connectivity, poor throughput, and degraded remote-management reliability."
  severity: medium
  category: hbom-performance
  dry-run-support: full
  condition: |
    components[
      (
        $prop($, 'cdx:hbom:hardwareClass') = 'modem'
        or $hasProp($, 'cdx:hbom:signalQuality')
      )
      and $hasProp($, 'cdx:hbom:signalQuality')
      and $number($prop($, 'cdx:hbom:signalQuality')) >= 0
      and $number($prop($, 'cdx:hbom:signalQuality')) < 25
    ]
  location: |
    {
      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
    }
  message: "Cellular component '{{ name }}' reports weak signal quality that may impair connectivity"
  mitigation: "Review antenna placement, carrier coverage, modem firmware, and access-technology selection before treating transport instability as an application-only issue."
  evidence: |
    {
      "signalQuality": $prop($, 'cdx:hbom:signalQuality'),
      "accessTechnologies": $prop($, 'cdx:hbom:accessTechnologies'),
      "operatorName": $prop($, 'cdx:hbom:operatorName'),
      "plugin": $prop($, 'cdx:hbom:plugin')
    }