# IQ 104 NuGet manifest analysis vs CycloneDX

**URL:** <https://community.sonatype.com/t/iq-104-nuget-manifest-analysis-vs-cyclonedx/5874>\
**Category:** Sonatype Lifecycle & Firewall\
**Tags:** nexus-iq\
**Created:** [February 11, 2021, 2:42pm UTC](https://community.sonatype.com/t/iq-104-nuget-manifest-analysis-vs-cyclonedx/5874 "2021-02-11T14:42:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![harley.hooper](https://avatars.discourse-cdn.com/v4/letter/h/ee59a6/32.png) [@harley.hooper](https://community.sonatype.com/u/harley.hooper)\
**Post date:** [February 11, 2021, 2:42pm UTC](https://community.sonatype.com/t/iq-104-nuget-manifest-analysis-vs-cyclonedx/5874/1 "2021-02-11T14:42:00Z")

</div>

Since the introduction of pecoff matching it’s been recommended to us that we use tools such as CycloneDX to generate a bill of materials to ensure we’re getting licence information from the NuGet packages (not something we can get from DLLs). From what we know this is using the packages.config and/or .csproj files to gather information about the packages/nuget components.

It looks like similar functionality to this has been introduced in Version 104 - is this intended to replace using CycloneDX to generate a BoM? Are there advantages and disadvantages to using either?

Ideally we’d like to keep things simple and use a single tool (the CLI) without having to use CycloneDX! Haven’t had change to fully test this yet though so I’m not sure what the main differences would be.