Add ETL-Based Security Pipeline Proposal Document - #237
Open
John15321 wants to merge 1 commit into
Open
Conversation
This document outlines a proposal for an ETL-based security pipeline that integrates LLM-assisted CVE triage for Flatcar vulnerabilities. It details the stages of the pipeline, the problem it addresses, and the proposed model for processing vulnerability information. Signed-off-by: Jan Bronicki <janbronicki@microsoft.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new proposal document describing an ETL-style (Extract → Transform → Triage → Load/Report) direction for integrating Flatcar vulnerability ingestion, matching, human/LLM-assisted triage, decision storage, and VEX generation.
Changes:
- Add an end-to-end pipeline proposal document covering data flow, decision records, revalidation, and reporting.
- Describe an LLM-assisted triage stage and potential GitHub-based review UX patterns.
- Outline open questions and possible future integration points (e.g., Trustify).
Suppressed comments (1)
proposal/pipeline-proposal.md:205
- This section proposes "one issue per CVE" as a primary option. The current Flatcar advisory issue style used by this project is per package/component update (title
update: <package-or-component-name>), often aggregating multiple CVEs when they share the same update action (see.github/copilot-instructions.md:263-311). Consider reframing this section to align with that established issue model, and treat CVE-level tracking as a secondary/canonical record only if needed.
One possible approach is to create one issue per CVE. This would provide a durable, linkable record for each CVE and allow the discussion, evidence, and decision to remain associated with that CVE.
However, a single CVE may affect multiple packages, channels, or releases. The issue would therefore need to contain multiple finding entries rather than assuming that one CVE always corresponds to one package or one release.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
|
||
| 1. Gather vulnerability information from multiple sources. | ||
| 2. Normalize and match advisories against Flatcar packages and releases. | ||
| 3. Create or update GitHub issues for findings that require review. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This document outlines a proposal for an ETL-based security pipeline that integrates LLM-assisted CVE triage for Flatcar vulnerabilities. It details the stages of the pipeline, the problem it addresses, and the proposed model for processing vulnerability information.