How to Generate VEX Automatically for Your Project
summary
Automatic VEX generation for container projects uses Kubescape plus Inspector Gadget eBPF to observe runtime file and memory use, cross-references SBOMs (Grype/Trivy) and produces VEX JSONs; a demo GitHub Action runs tests, takes ~4 minutes, outputs four VEX files and filtered a scan by ignoring ~245 issues, yielding 80–90% noise reduction. Implementation details include installing Kubescape as an operator, enabling VEX feature flag, and known Grype/Trivy integration quirks. Kubescape + Inspector Gadget eBPF and GitHub Action for VEX generation
AI-written summary · about
chapters (11)
- 0:00Welcome
- 2:47SBOM limitations
- 8:11Reachability analysis
- 13:11What is VEX
- 15:00Generating VEX with Cube Escape
- 17:47Automating VEX with GitHub Actions
- 22:44Call to action
- 24:32Test coverage and false negatives
- 28:11Smaller container images
- 30:40VEX in scanners
- 31:46Q&A
related talks
24mEmbracing the Era of Transparency: Automating VEX Application for Scalable, Context-Aware Security
26mStreamlining Vulnerability Management: The Power of VEX Inheritance in Container Ecosystems
56mFrom SBOM to VEX - Discovering What's in the Box and How Badly it Can Hurt You
26mWeaving a VEX Feed Through the Kubernetes Project
27mWeaving a VEX Feed Through the Kubernetes Project
48m5 Steps to VEX Success: Managing the End-to-End Workflow
33mEnabling VEX and Full SBOM Coverage with Wolfi Based Containers
45mVEXing Open Source Security: Vulnerability Data for Everything