Managing Application Level SBOMs with Ortelius
summary
Ortelius is a microservice catalog that collects component-level SBOMs, CVE data and deployment metadata and aggregates SBOMs up to application level so teams see which applications include which low-level packages. It tracks component versions, git commits, Helm charts and deployments across clusters and namespaces, generates difference reports over time, and can predict blast radius and locate instances of libraries like log4j. Integrations include Cyclone and Backstage and the system surfaces who owns a component, where it’s running, and which app releases a change causes.
AI-written summary · about
chapters (8)
- 0:00Start
- 0:59The Demand for Hardening the Supply Chain
- 3:30Monolith vs. Microservice SBOMs
- 5:20Loss of the Application Version
- 8:39Meet the Ortelius Catalog for Service Governance
- 11:29Meet the Users
- 25:12Component and Application Versions
- 26:32How it works - Data Gathered
related talks
33mMicroservice Supply Chain and the Ortelius Application SBOMs
34mTransforming SBOMs from Compliance Burden to Security Asset
38mWhat the &#% Is in That SBOM? How to Provide Users What Software Components Are Included
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...
35mTransforming SBOMs from Compliance Burden to Security Asset
47mThe Missing Link - How we collect and leverage SBOMs
22mGuardians of Code: Continuously Monitoring Security and DevOps Compliance
38mThe State of SBOMs