Monitoring & Compliance
11 tutorials in this category.
03
How to Export Your Software Bill of Materials (SBOM) in CycloneDX Format
Generate a CycloneDX 1.6 SBOM from the BOM page, filter by client/ecosystem/package, and integrate SBOM exports into your compliance workflow.
03
How to Monitor Supply Chain Violations and Respond to Blocked Packages
Use the violations dashboard, filter by severity, review violation history, and create exceptions for approved packages.
04
How to Answer "Are We Affected by CVE-X?" Using the Inventory Dashboard
When a new CVE drops, you have minutes to answer "are we exposed?". Walks through the /inventory dashboard, the chainsaw_query_inventory MCP tool, and the dependsOn-graph search that finds transitive exposure.
04
How to Export and Analyze Your BOM as CSV
Export the full bill of materials with supply chain columns, filter before export, and use the CSV for compliance reporting.
04
How to Review and Manage Quarantined Packages
Understand the quarantine workflow, review flagged packages, approve or reject quarantined items, and transition from quarantine to blocking policies.
04
How to Set Up Release Freshness Guards to Block New Packages
Configure package age policies to block packages younger than N days, protecting against attacks that exploit freshly published malicious versions.
05
How to Investigate a Violation in the BOM Inspector
When a violation fires, the per-package timeline tells you what to do about it. Walk through the BOM inspector — findings list, signal evidence, dependency paths, and one-click drill from violation to owner.
05
How to Use Audit Logs to Track Package Consumption and Policy Changes
Navigate the audit page, filter events by actor/action/date, and build an audit trail for compliance reviews.
06
How to Send Violations to Splunk HEC, Microsoft Sentinel, or IBM QRadar
Wire Chainsaw's audit and violation streams into your existing SIEM. Walk through the three exporter types — Splunk HEC JSON, Sentinel CEF over syslog, QRadar CEF over syslog — and the durable replay semantics that mean a SIEM outage doesn't lose events.
07
How to Send HMAC-Signed Outbound Webhooks to Slack, Teams, PagerDuty, and Jira
Configure outbound webhook destinations, verify the HMAC signatures on receivers, and route events with per-team destination maps — including SSRF protection, per-org rate limits, retry/backoff, and DLQ handling.
08
How to Enforce Chainsaw Org-Wide
Layer CI checks, MDM policy, and network egress controls so every package install across the org routes through Chainsaw — without Chainsaw trying to be an endpoint agent.