In recent years, SBOM became an emerging topic to address the need to understand and track the software supply chain and gather a better understanding of the software composition that is used in our modern infrastructure. Often heard promises are to be able to much faster identify and address vulnerabilities in upstream dependencies like Log4j or to mitigate supply-chain attacks like the XZ Utils attack. But what can it look like to work with SBOMs? This workshop introduces an orientation on the tools and standards at hand and provides practical examples of how and when to generate SBOMs, how to assess their quality, and how to merge and consume them.