Incident response

Consumers and SBOMs

Answer "who uses this package" and export a bill of materials per application.

Search Consumers by package name, file sha256 or advisory id. Results show every application, environment, developer, pipeline and address that downloaded it, with first and last dates.

Under SBOM of an application, pick an application and environment and export CycloneDX or SPDX, built from what that application actually downloaded. How long this history is kept is Days to remember who consumed what (Settings, Cache, default 365).