MetricCA: Revolutionizing Metrics Collection & Analysis
summary
MetricCA automatically pulls security evidence from Confluence, Jira, Dependency-Track and Azure AD and combines that with repository YAMLs — activities.yaml, teams.yaml, configuration.yaml — to evaluate DevSecOps maturity. The analyzer converts inputs to Java objects, generates JSON schemas to validate PRs, and emits Grafana dashboards and alerts (for example, missing quarterly threat modeling). Project is open source on GitHub, sponsored by a Swiss org, and aims for full implementation by end of 2023.
AI-written summary · about
chapters (17)
- 0:00intro
- 1:43who is timo
- 2:02agenda
- 2:15devsecops maturity models
- 3:26devsecops assessment
- 4:33sources
- 5:17metric collector and analyzer (metricca)
- 7:52manual overview
- 8:44threshold flow
- 9:51architecture
- 10:12uml
- 11:03yaml
- 11:35configuration.yaml
- 11:58activities.yaml
- 12:19silverbullet? people and processes
- 12:55notes
- 13:27questions?
related talks
41mHow To Connect The Dots
48mMeasuring DevSecOps: building metrics to understand effectiveness and success
34mBuilding DevOps Metrics for your Choice of CD Tools Through CD...
36mBuilding DevOps Metrics for your Choice of CD Tools Through CDE...
01h 00mTop 10 Metrics for Successful DevSecOps Projects
26mBuilding & Supporting Open Source Communities Through Metrics
46mEngineering Intelligence via Engineering Metrics
53mUsing Metrics to Take a Hard look at your code