Layanan keamanan

Rangkaian layanan keamanan first-party ing kotoba.cloud. Temuan CTEM, DAST, lan SAST mili menyang buku besar VM ing siji skema bareng.

CTEM

exposure-management komponen wis dikirim

Continuous Threat Exposure Management: terus-terusan nemtokake permukaan serangan eksternal lan titik mlebu, lan mènèhi jalur serangan plus konteks aset menyang buku besar VM.

Kapabilitas	Katrangan
surface-inventory	inventarisasi aset lan permukaan serangan eksternal sing terus-terusan
attack-path	identifikasi jalur serangan sing bisa dijangkau
context	konteks aset (rute publik, dependensi, pemilik)
exposure-feed	kedadean eksposur sing diumpakake menyang buku besar VM

input: assets, dns, certificates, open-endpoints
output: attack-paths, exposure-findings, asset-context
Integrasi VM: CTEM mènèhi jalur serangan lan konteks aset menyang buku besar VM; iki dadi dhasar skor reachability.

DAST

dynamic-testing dikunci

Dynamic application security testing: mriksa aplikasi sing lagi mlaku lan nglapurake temuan runtime menyang buku besar VM.

Kapabilitas	Katrangan
runtime-probe	pengujian dinamis aplikasi sing lagi mlaku
auth-scenarios	pengujian kanthi skenario terotentikasi
runtime-finding	deteksi kerentanan runtime dadi temuan

input: running-apps, scan-scopes, auth-scenarios
output: runtime-findings, request-response-evidence
Integrasi VM: DAST ngasilake temuan runtime sing bisa diulang (bukti request/response) menyang buku besar VM.

SAST

static-analysis dikunci

Pengujian keamanan aplikasi statis: nganalisis kode sumber kanggo nemokake pola rawan lan sanitasi sing kurang, banjur nglaporake temuan kode menyang buku besar VM.

Kapabilitas	Katrangan
code-analysis	analisis statis kode sumber
taint-flow	inspeksi taint / data-flow
code-finding	temuan kode kanthi file lan baris

input: source-code, dependency-manifests
output: code-findings, taint-paths, dependency-notes
Integrasi VM: SAST ngasilake temuan kode karo file lan baris menyang buku besar VM, saengga target dandanan luwih cepet ditemokake.

VM

vulnerability-management komponen wis dikirim

Manajemen kerentanan (wvme): nampa temuan skema bareng sing digawe dening telung layanan upstream, nglakoni dedup lan nskoring adhedhasar reachability lan exploitability, lan nglacak siklus urip remediasi ing buku besar sing dikunci nganggo CPE/CVE. Nampa input feed CVE/CPE.

Kapabilitas	Katrangan
dedup	dedup temuan (kunci aset × kerentanan)
scoring	nskoring reachability × exploitability
ledger	buku besar kerentanan kanthi kunci CPE/CVE
remediation	siklus urip remediasi (kedeteksi → lagi dikerjakan → wis diverifikasi → ditutup)
cve-cpe-feed	Panampan feed CVE/CPE

input: findings-from-ctem, findings-from-dast, findings-from-sast, cve-cpe-feeds
output: vulnerability-ledger, remediation-status, exposure-reports
Integrasi VM: VM iku layanan buku besar: nampa temuan telung layanan upstream ing skema bareng lan nglakoni dedup, nskoring, lan nglacak remediasi.

Aliran data menyang buku besar VM

Telung layanan upstream ngasilake temuan skema bareng; VM nglakoni dedup, nskoring, lan nglacak remediasi.

→ CTEM · peran: attack-path-and-context
→ DAST · peran: runtime-findings
→ SAST · peran: code-findings
→ VM · peran: aggregation-ledger · ledger keys: cpe, cve

finding schema: finding-id, service, asset, severity, evidence, first-seen, last-seen

Kaca iki lan GET /v1/security/services dirender saka siji definisi kanonikal. Penerapan (enforcement) tetep ana ing authority pribadi; permukaan iki mung njlentrehake.