SBOMs are currently generated as part of attaching an asset to an app version. Where generation happens depends on the asset. AnchoreCTL generates the SBOM locally when it can read the source itself, such as a filesystem directory or a container image analyzed on your host, while centralized image analysis generates it server-side. For anything else, generate the SBOM with your own tooling and upload it as an SBOM asset. Either way, the SBOM is stored against the version where it becomes available for vulnerability analysis, policy evaluation, search, and export.
Coming soon: standalone SBOM generation. A future release of Anchore Enterprise will let AnchoreCTL produce an SBOM locally and write it to a file or stream without storing the result in Anchore Enterprise.