Abstract: A method, computer system, and computer program product are provided for analyzing software applications for risk. Data is obtained indicating one or more components of an application and historical data relating to one or more previous versions of the application. The historical data is analyzed to identify one or more vulnerabilities present in the one or more previous versions of the application. A software bill of materials is generated for the application based on the one or more components of the application, wherein the software bill of materials includes risk metadata descriptive of the one or more vulnerabilities of the application. The risk metadata associated with the software bill of materials is analyzed to determine a risk score for the application.

Abstract: Techniques for introducing Open Telemetry (OTEL) into the operating system (OS) level of network devices are described. A method for performing OTEL network device management may include receiving, by a network device, a first packet. The method may also include identifying, by the network device, that the first packet contains information indicating an active OTEL trace, wherein the OS of the network device is configured for OTEL. The method may also include generating, by the network device, an OTEL trace span associated with the network device. The method may also include generating, by the network device, a second packet that includes the OTEL trace span associated with the network device. Finally, the method may include transmitting, by the network device and via OTEL line protocol (OTLP) the second packet to an OTEL collector.

Abstract: Techniques for introducing Open Telemetry (OTEL) into the operating system (OS) level of network devices are described. A method for performing OTEL network device management may include receiving, by a network device, a first packet. The method may also include identifying, by the network device, that the first packet contains information indicating an active OTEL trace, wherein the OS of the network device is configured for OTEL. The method may also include generating, by the network device, an OTEL trace span associated with the network device. The method may also include generating, by the network device, a second packet that includes the OTEL trace span associated with the network device. Finally, the method may include transmitting, by the network device and via OTEL line protocol (OTLP) the second packet to an OTEL collector.

Abstract: A method of application program interface (API) endpoint host redirection may include with an intelligent domain name system (DNS) engine (IDE) associated with a containerized service within a pod of a mesh network, snooping a DNS query from the containerized service, identifying within the DNS query, an API endpoint name, snooping a DNS response associated with the DNS query, identifying an Internet protocol (IP) address associated with the API endpoint name, transmitting the API endpoint name and the IP address to a controller, receiving, from the controller, a list of safe API endpoint hosts with no known security vulnerabilities based on security data obtained from at least one security service, caching, at the IDE, the list of safe API endpoint hosts including safe IP addresses, and transmitting to the containerized service, via the IDE, IP addresses of safe API endpoint hosts within the list of safe API endpoint hosts.

Abstract: A method of application program interface (API) endpoint host redirection may include with an intelligent domain name system (DNS) engine (IDE) associated with a containerized service within a pod of a mesh network, snooping a DNS query from the containerized service, identifying within the DNS query, an API endpoint name, snooping a DNS response associated with the DNS query, identifying an Internet protocol (IP) address associated with the API endpoint name, transmitting the API endpoint name and the IP address to a controller, receiving, from the controller, a list of safe API endpoint hosts with no known security vulnerabilities based on security data obtained from at least one security service, caching, at the IDE, the list of safe API endpoint hosts including safe IP addresses, and transmitting to the containerized service, via the IDE, IP addresses of safe API endpoint hosts within the list of safe API endpoint hosts.

Abstract: A method, computer system, and computer program product are provided for analyzing application programming interface (API) transactions for risk. A call stack is analyzed in relation to an incoming API request to identify one or more application components of the call stack that relate to the API request. A software bill of materials is obtained for each of the one or more application components. Risk metadata associated with each software bill of materials is analyzed to determine that the API request satisfies one or more risk criteria. A response to the API request is provided.

Abstract: A method, computer system, and computer program product are provided for analyzing software applications for risk. Data is obtained indicating one or more components of an application and historical data relating to one or more previous versions of the application. The historical data is analyzed to identify one or more vulnerabilities present in the one or more previous versions of the application. A software bill of materials is generated for the application based on the one or more components of the application, wherein the software bill of materials includes risk metadata descriptive of the one or more vulnerabilities of the application. The risk metadata associated with the software bill of materials is analyzed to determine a risk score for the application.

Abstract: A method of application program interface (API) endpoint host redirection may include with an intelligent domain name system (DNS) engine (IDE) associated with a containerized service within a pod of a mesh network, snooping a DNS query from the containerized service, identifying within the DNS query, an API endpoint name, snooping a DNS response associated with the DNS query, identifying an Internet protocol (IP) address associated with the API endpoint name, transmitting the API endpoint name and the IP address to a controller, receiving, from the controller, a list of safe API endpoint hosts with no known security vulnerabilities based on security data obtained from at least one security service, caching, at the IDE, the list of safe API endpoint hosts including safe IP addresses, and transmitting to the containerized service, via the IDE, IP addresses of safe API endpoint hosts within the list of safe API endpoint hosts.