Post #2306429
2026-05-08 20:54 UTC
Replies (4)
-
@dentaku@fnordon.de 2026-05-08 21:11
@mcfly@milliways.social We run Trivy Operator in our k8s clusters for vulnerability scanning, also for config audits. For more config best practices checks we use Fairwinds Polaris. In addition we have multiple static analysis tools (BlackDuck, Sonarqube, Snyk). We try to get rid of Azure Defender though. The main problem with that setup is to collect all the results and get them to the right people. That's why I want to look into vulnerability management tools like Defect Dojo soon.
-
@musevg@23.social 2026-05-08 21:11
@mcfly@milliways.social @remindme@mstdn.social 3d
-
@cy@chaos.social 2026-05-09 17:30
@mcfly@milliways.social *dependency-check / -track for third party dependency issues, * gitlab SAST /sonarqube for static code analysis, * automated zap scan on every pull request (in some projects, preferably feeding openapi spec to the scanner) *trivy for containers currently researching trying the security-review from claude code, might give claude security a chance as well soon. (R&D)
-
@pitch@social.flipdot.org 2026-05-11 09:56
@mcfly@milliways.social "Hey ChatGPT, how does my enterpricey environment get sefe pretty plz?" /s 🤡 Getting notified about derivation from normal behaviour. HDD load on backupsystem lower or mass request at 3 am to the Loginservice > Warning. It was done by a Software accessing Prometheus/grafana (not sure which) and just using the status quo as "normal" and warn about derivations. Whenever a warning was generated it was either flagged as 'resolved' w no further action or 'normal' and added to learned pattern.