supply-chain-forensics

To detect dependency tampering, supply chain forensics checks package integrity against registry hashes to identify anomalies and typosquatting. This process validates dependencies to ensure package integrity across your software supply chain.

Auditing CI/CD pipelines for malicious patterns involves scanning workflows for unpinned actions and unauthorized changes. Build pipeline forensics scans your scripts to detect tampering and map findings to MITRE ATT&CK techniques for supply chain attacks.

Generating and validating a Software Bill of Materials (SBOM) identifies components, licenses, and vulnerabilities. Supply chain forensics performs SBOM analysis using tools like CycloneDX to ensure component integrity and detect known vulnerabilities via OSV.dev.

Yes, you can assess build reproducibility to determine if build artifacts can be consistently recreated. Supply chain forensics evaluates your build processes and maps the reproducibility findings directly to SLSA levels for compliance tracking.

Yes, supply chain security analysis requires external tools for package management, SBOM generation like CycloneDX, vulnerability scanning like OSV.dev, and Git history analysis to perform comprehensive dependency verification and build pipeline forensics.