Why Don’t We Have Both? Track Build- and Run-time Information for Security With Kubescape and GUAC
Talkat KubeCon + CloudNativeCon Europe 2025 · on Friday, 2025-04-04· at 15:15· Level 1 | Hall Entrance S10 | Room B·
summary
GUAC ingests Kubescape SBOM custom resources via a Cubescape collector that watches the Kubernetes API and stores image, build, source and filtered SBOM variants in a GraphQL-backed graph. Kubescape uses eBPF file activity to mark packages as loaded at runtime, producing filtered SBOMs that cut reported vulnerabilities by 70–90% noise reduction in many apps. Demo shows GraphQL queries and a visualizer, and notes limitations: monitoring window and potential missed eBPF events can omit some runtime hits.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:04Agenda overview
- 1:25What is GUAC and GraphQL API
- 5:01Cubescape project intro
- 7:27Vulnerability management challenges
- 9:15Reachability analysis with eBPF
- 15:02Cubescape and GUAC integration
- 16:05Demo: SBOMs in GUAC
- 22:48SBOM analysis takeaways
- 24:58Q&A
related talks
37mEliminating the Unknowns: Using GUAC to Better Understand Your Software Supply...
40mWhere Is the GUAC?
10mCharting the Course for Secure Software Supply Chain with Guac-AI-Mole!
36mA Mouthful of Mayhem: Taste Test and Gut Response to SLSA, GUAC, and Supply Chain’...
56mFrom SBOM to VEX - Discovering What's in the Box and How Badly it Can Hurt You
34mIt's Dangerous To SLSA Alone Out There! Take This Artifact Knowledge Graph!
36mSBOMs, VEX, and Kubernetes
07mA Teen’s Perspective on Navigating Open Source Security with GUAC