Charting the Course for Secure Software Supply Chain with Guac-AI-Mole!
summary
A prototype called Guac-AI-mole converts plain-English queries into GraphQL against GUAC, pulls SBOMs from OCI registries using OCI refer/oras, and correlates graph results with kubectl output to locate running vulnerable images. Demo shows it identifying Log4J packages, finding images that depend on them, and confirming a running pod using the vulnerable image. Implementation uses LLM agent chains to synthesize queries; it works as a proof‑of‑concept but is not production ready.
AI-written summary · about
chapters (9)
- 0:00Guac-AI-Mole introduction
- 1:46What is Guac and graph data
- 2:28Hackathon goals and LLM
- 3:09Collecting SBOMs from OCI
- 3:31Integrating Kubernetes data
- 3:51Live demo setup and data
- 6:02Natural language with Guac
- 9:41Demo results and vulnerabilities
- 10:02Next steps and status
related talks
37mEliminating the Unknowns: Using GUAC to Better Understand Your Software Supply...
40mWhere Is the GUAC?
33mMind the Gap: Bridging Supply Chain Policy With Git-less GitOps and GUAC
36mA Mouthful of Mayhem: Taste Test and Gut Response to SLSA, GUAC, and Supply Chain’...
29mWhy Don’t We Have Both? Track Build- and Run-time Information for Security With Kubescape and GUAC
34mIt's Dangerous To SLSA Alone Out There! Take This Artifact Knowledge Graph!
44mImproving the Software Supply Chain Security
27mSecuring Open Source With SBOM: From Visibility To Trust