Presentation Material

AI Generated Summary^{may contain errors}

Here is a summarized version of the content:

The speaker demonstrates Dependency Track, a vulnerability identification tool that scores risks based on City. The demo shows how to create a project, analyze pip packages in Python, using Build Inspector, which converts Json logs into Cyclone DX format. The output is PIP serializer XML, which is then analyzed by Dependency Track to identify vulnerabilities.

The speaker highlights the challenges of automating vulnerability identification and recommends an architecture that can scale. This involves using microservices with Kubernetes, where log collector services connect to CI systems, pulling logs that are fed into Build Inspector for analysis. The output can be stored or used as an API, providing insights on pipeline issues and threats.

The speaker invites contributions to the open-source Build Inspector project on GitHub, which can involve updating extraction rules using Yara, integrating dependency managers, fixing bugs, or adding new features.