Learn New Ways of Tracking Security and DevOps Intelligence with Ortelius
summary
742% growth in malicious supply chain attacks and 65–80% of companies needing more visibility drive Ortelius to do specific work: it ingests SBOMs from CI (GitHub Actions, Docker/Quay registries), persists component versions in ArangoDB, queries OSV for CVEs, and aggregates everything up to a logical application so the system creates automatic logical release numbers whenever underlying services change. Emporous (Red Hat) provides a universal object reference backend, a Ripple-funded immutable SBOM ledger is planned, and REST APIs/CLI enable deployments, drift reporting across clusters, and OPA-style policy inputs.
AI-written summary · about
chapters (8)
- 0:00Ortelius and DevOps security
- 2:31Trapped DevOps and security data
- 7:45Ortelius architecture and Red Hat UOR
- 10:14Centralizing DevOps and security data
- 15:29Tracking microservices versions
- 19:45Log4j tracking need
- 22:35Future of intelligent DevSecOps
- 25:48Q&A on integrations
related talks
22mGuardians of Code: Continuously Monitoring Security and DevOps Compliance
21mTracking DevOps Data in Event Driven CD Pipelines
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
22mThe Ortelius Journey with GitOps and Event Driven CI/CD
33mORT Automate compliance using Open Source & InnerSource
24mFortiying Tomorrow’s CD Pipelines: Harnessing the Power of DevSecOps Data Using...
34mTransforming SBOMs from Compliance Burden to Security Asset
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page