Product guide
SBOM, vulnerability, and decision context
Manage OSV data, CycloneDX scans, findings, policies, and risk acceptances in a traceable model.
Responsibility
Intelligence Management ingests vulnerability data, projects SBOM components, and evaluates findings against applicable policy context.
Verified features
- Full or incremental OSV synchronization
- Project- and environment-scoped CycloneDX scanning
- Immutable scan and evaluation history
- Central policy, risk acceptance, CLI, and API automation
- Read-only HTTP MCP for organization/project discovery plus vulnerability and remediation context during development
Data and evaluation flow
Managed OSV sources update vulnerability data through full or incremental tasks. Full tasks retrieve the official all.zip archive, while incremental tasks retrieve modified_id.csv and changed advisory JSON objects over HTTPS from storage.googleapis.com/osv-vulnerabilities/. When a CycloneDX SBOM is scanned in organization, project, and environment context, components, dependencies, and findings are recorded; applicable policy produces a separate evaluation result for that immutable scan input.
Why is internet access required?
Smart Kubaba does not ship a fixed vulnerability database inside the installation package. Controlled internet egress from the application pod or configured system proxy is required because the first full synchronization and later incremental updates download official OSV distribution objects. Direct access to the osv.dev website is not required.
- Allow only the storage.googleapis.com/osv-vulnerabilities/ path over HTTPS; redirects are not followed.
- Full synchronization downloads all.zip and can resume it on durable work storage; incremental synchronization downloads modified_id.csv and selected JSON records.
- DNS, corporate CA and TLS validation, firewall allowlisting, and system-proxy access where required must all be available.
- If connectivity is lost, the task may enter Retry Wait or Failed and the cursor does not advance; existing local data remains usable but current vulnerability coverage cannot be guaranteed.
- This automatic flow does not operate in an air-gapped installation; a verified offline data-transfer procedure has not yet been published.
Environment catalog and reevaluation
The central Environment page manages scan context through an immutable environment key. Environment-scoped policies are resolved when a scan is created, and completed historical scans can be queued again with RunScanReevaluation either manually or through a six-field Spring cron schedule.
- The Environment list and Scan History are linked through an exact environment filter.
- Scheduled reevaluation triggers only for active environments; manual evaluation can also process inactive history.
- Queued, processing, retrying, or incomplete scans are not queued again.
- Progress and results remain visible in durable Scan Evaluation tasks; historical decisions are not deleted.
Traceability
During technical acceptance, retain the source-synchronization task, SBOM checksum, scan identity, finding match, policy evaluation, and any risk acceptance in one evidence chain.
- Checkpoint, counters, and item-level failure result for full and incremental OSV tasks
- Consistent component, dependency-edge, and finding counts for the same SBOM input
- Separation of the new evaluation from historical results after policy or intelligence changes
- Risk acceptance matched to scope, rationale, expiry, and audit record
Analysis boundary
Verified intelligence scope covers OSV vulnerability data and CycloneDX component relationships. Malware detection, license compliance, namespace confusion, quarantine, and independent-assurance claims are not part of this scope.