Compliance

10 tutorials in this category.

03 How to Enforce License Compliance Across Your Supply Chain Set up SPDX license allowlists and blocklists in policies, monitor license coverage from the dashboard, and handle unknown licenses. Intermediate 20 minutes Security Engineers / Compliance Teams 03 How to Export Your Software Bill of Materials (SBOM) in CycloneDX Format Generate a CycloneDX 1.6 SBOM from the BOM page, filter by client/ecosystem/package, and integrate SBOM exports into your compliance workflow. Beginner 15 minutes Compliance Teams / Security Engineers 04 How to Export and Analyze Your BOM as CSV Export the full bill of materials with supply chain columns, filter before export, and use the CSV for compliance reporting. Beginner 10 minutes Compliance Teams / Security Engineers 05 How to Deploy Chainsaw in an Air-Gapped Environment Stand Chainsaw up on a network with no outbound internet: bundle the binary, Trivy vuln DB, and upstream artifacts on an online staging box, transfer them across, and run the proxy offline with OpenSSF / Billy / telemetry cleanly disabled. Advanced 45–60 minutes (first time); 15 minutes for subsequent upgrades Platform / Security Engineers in regulated environments 05 How to Use Audit Logs to Track Package Consumption and Policy Changes Navigate the audit page, filter events by actor/action/date, and build an audit trail for compliance reviews. Beginner 15 minutes Compliance Teams / Security Engineers 05 How to Use Country and IP-Based Access Policies Configure GeoIP-based policies to restrict package access by country, and create IP allowlists/blocklists for network-level access control. Advanced 20 minutes Security Engineers / Compliance Teams 06 How to Send Violations to Splunk HEC, Microsoft Sentinel, or IBM QRadar Wire Chainsaw's audit and violation streams into your existing SIEM. Walk through the three exporter types — Splunk HEC JSON, Sentinel CEF over syslog, QRadar CEF over syslog — and the durable replay semantics that mean a SIEM outage doesn't lose events. Intermediate 30 minutes SOC Engineers / Security Engineers 08 How to Enforce Chainsaw Org-Wide Layer CI checks, MDM policy, and network egress controls so every package install across the org routes through Chainsaw — without Chainsaw trying to be an endpoint agent. Advanced 45 minutes Security Engineers / Platform Engineers 10 How to Detect Bypass Attempts with `chainsaw doctor --bypass-check` Find clients that are still reaching the public registries directly — the proxy is in place, but did everyone actually point at it? Two complementary surfaces: the doctor command from each client, and the `direct_registry_egress` view from the control plane. Intermediate 20 minutes Security Engineers / Platform Engineers 13 How to Refuse Installs When a Required Signal Could Not Be Evaluated Turn on the optional fail-closed coverage gate: declare the data sources that must be evaluable, measure in warn mode, then refuse instead of allowing unchecked. Off by default. Advanced 30 minutes Platform Engineers / Security Engineers in regulated environments