Security services
Na the first-party security services suite wey dey for kotoba.cloud. CTEM, DAST and SAST findings dey flow enter the VM ledger wit one shared schema.
CTEM
exposure-management component wey dem don shipContinuous Threat Exposure Management: e dey continuously count external attack surface and entry points, and e dey hand attack paths plus asset context give VM ledger.
| Capability | Description |
|---|---|
| surface-inventory | continuous external attack-surface and asset inventory |
| attack-path | identification of attack-path wey dem fit reach |
| context | asset context (public routes, dependencies, owner) |
| exposure-feed | exposure events wey dem feed enter the VM ledger |
- inputs: assets, dns, certificates, open-endpoints
- outputs: attack-paths, exposure-findings, asset-context
- VM integration: CTEM dey hand attack paths and asset context give VM ledger; dem be di basis for reachability score.
DAST
dynamic-testing gatedDynamic application security testing: e dey probe applications wey dey run and e dey report runtime findings go VM ledger.
| Capability | Description |
|---|---|
| runtime-probe | dynamic probing of applications wey dey run |
| auth-scenarios | probing wit authenticated scenarios |
| runtime-finding | detect runtime vulnerability turn am to findings |
- inputs: running-apps, scan-scopes, auth-scenarios
- outputs: runtime-findings, request-response-evidence
- VM integration: DAST dey send reproducible runtime findings (request/response evidence) go VM ledger.
SAST
static-analysis gatedStatic application security testing: e dey analyze source code to find vulnerable patterns and missing sanitization, then report code findings go the VM ledger.
| Capability | Description |
|---|---|
| code-analysis | static analysis for source-code |
| taint-flow | taint / data-flow inspection |
| code-finding | code findings wit file and line |
- inputs: source-code, dependency-manifests
- outputs: code-findings, taint-paths, dependency-notes
- VM integration: SAST dey send code findings wit file and line go VM ledger, so dem go fit find di fix target faster.
VM
vulnerability-management component wey dem don shipVulnerability management (wvme): e dey take the shared-schema findings wey the three upstream services emit, dedup and score dem based on reachability and exploitability, then track the remediation lifecycle inside ledger wey dem key by CPE/CVE. E dey accept CVE/CPE feed input.
| Capability | Description |
|---|---|
| dedup | finding deduplication (asset × vulnerability key) |
| scoring | reachability × exploitability scoring |
| ledger | vulnerability ledger wey dem key with CPE/CVE |
| remediation | remediation lifecycle (detected → in progress → verified → closed) |
| cve-cpe-feed | CVE/CPE feed intake |
- inputs: findings-from-ctem, findings-from-dast, findings-from-sast, cve-cpe-feeds
- outputs: vulnerability-ledger, remediation-status, exposure-reports
- VM integration: VM na the ledger service: e dey receive the findings of the three upstream services inside shared schema, e dey dedup dem, score dem, and track remediation.
How data dey flow enter VM ledger
The three upstream services dey emit findings wit shared-schema; VM dey dedup dem, score dem, and track how dem dey fix am.
- → CTEM · role: attack-path-and-context
- → DAST · role: runtime-findings
- → SAST · role: code-findings
- → VM · role: aggregation-ledger · ledger keys: cpe, cve
finding schema: finding-id, service, asset, severity, evidence, first-seen, last-seen
This page and GET /v1/security/services dey render from the one canonical def. Enforcement dey stay wit the private authority; this surface na just to describe.