# Does Syft automaticaly detects existing SBOM files?

**URL:** <https://anchorecommunity.discourse.group/t/does-syft-automaticaly-detects-existing-sbom-files/372>\
**Category:** Syft\
**Created:** [March 20, 2025, 10:00am UTC](https://anchorecommunity.discourse.group/t/does-syft-automaticaly-detects-existing-sbom-files/372 "2025-03-20T10:00:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![gillg](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/gillg/32/260_2.png) [@gillg](https://anchorecommunity.discourse.group/u/gillg)\
**Post date:** [March 20, 2025, 10:00am UTC](https://anchorecommunity.discourse.group/t/does-syft-automaticaly-detects-existing-sbom-files/372/1 "2025-03-20T10:00:00Z")

</div>

Assuming I use another tool thant Syft for more accurate SBOM generation during the build of my application (less hidden dependancies, and deeper scaning of licences and libs), if the SBOM (JSON Spdx for example) is present in the docker image or the filesystem, is it possible for Syft to parse it and merge it in the final report ?

---

<div class="post-metadata">

**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\
**Post date:** [March 20, 2025, 7:06pm UTC](https://anchorecommunity.discourse.group/t/does-syft-automaticaly-detects-existing-sbom-files/372/2 "2025-03-20T19:06:38Z")

</div>

Hello, @gillg!

Yes! There is an `sbom-cataloger`, but this is disabled by default. You can enable it using `syft --select-catalogers +sbom-cataloger`. This will _also_ continue to run all the other catalogers, there are some other options to adjust which catalogers run.