This section guides you through the functions of Kiuwan Insights.
Contents:
| Table of Contents |
|---|
Kiuwan Insights Dashboard:
Introduction
Introduction to Kiuwan Insights
Many applications Today’s time-to-market imposes high pressure on releasing new versions of your application. Productivity becomes essential. And most of the times, you will incorporate external open source and third-party components that let you enable developers to build new functionality very fast and with the minimum effort.
Open Source repositories provides huge amounts of software that lets you to build new applications very fast and robustly.
But not all are benefits; there might be also some drawbacks when using open source components.
First obvious question has to do with how much open source software is your application using.
quickly and efficiently. But while the use of open source components has many benefits, it also introduces risk. Kiuwan Insights helps you manage this risk by providing answers to the key questions described below.
| Info | ||
|---|---|---|
| ||
| ||
| Info | ||
Do you have a complete components inventory with all the 3rd party
|
...
|
...
|
...
|
...
|
...
|
...
|
| Warning |
|---|
Are those components obsolete? You
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
|
...
...
|
| Tip | title | Kiuwan Insights
|---|
Kiuwan Insights comes to answer all these questions by providing:
|
At a glance, Kiuwan Insights provides visual indicators that quickly let you to know the different levels of risk associated to every external component.
Every component is assigned a level (High, Medium, Low or None) on three different risk metrics:
- Security Risk (due to vulnerabilities introduced by components)
- Obsolescence Risk (due to using obsolete components)
- License Risk (due to legal implications of used components’ licenses)
Components Inventory
If you are a developer, you most probably will access to build systems where external components are “identified”.
But, are those 3rd party components part of a “controlled” inventory? Most probably, don’t.
|
Components Inventory
| Excerptinfo |
|---|
Kiuwan Insight analyzes your application software, discovering all external dependencies, and builds a Components Inventorycomponents inventory that lets you track of any external piece of code that could be part of your application. Go to Insights > Components to access the components inventory. Supported languages and resourcesKiuwan Insights uses the following resources to extract information on 3rd |
...
party dependencies. |
...
|
...
|
...
.Net
...
- Nuget
...
- Nuget
...
Python
...
- PyPI
- GitHub
...
- PyPI
- Requirements (txt file with declared deps)
...
Swift
...
- Cocoapods
- GitHub
...
- Podspec
- Package
...
Php
...
- Packagist
...
- Composer
|
Database vulnerabilities
From these sources, Kiuwan Insight builds the Components Inventory of your application.
You can add your specific private (local or remote) and/or public repositories by properly configuring Kiuwan Local Analyzer.
Please visit Insights - Additional Maven repositories for further information.
Security, Obsolescence, and Licensing
At a glance, Kiuwan Insights provides detailed information and visual indicators that quickly let you know the different levels of risk associated with every external component.
Every component is assigned a level (High, Medium, Low or None) on three different risk metrics:
- Security Risk (due to vulnerabilities introduced by components)
- Obsolescence Risk (due to using obsolete components)
- License Risk (due to legal implications of used components’ licenses)
| Info |
|---|
Security information is available at Insights > Security Obsolescence information is available at Insights > Obsolescence |
From these sources, Kiuwan Insight builds the Components Inventory of your application.
| Info |
|---|
Components Inventory is accessible trough Insights >> Components tab. |
Insights >> Components
Insight >> Components tab displays Components Inventory:
- Overall Information on Components – aggregated information on number and type of components
- List of Components – detailed listing of components
- Component detail – detailed information on selected component
Overall Information on Components
- Number of components by language
- Number of components by Security Risk level (High, Medium, Low and None)
- Alerts :
- Components with High Security Risk
- Components being used with different versions that might be cause conflicts
- Etc.
List of Components
Kiuwan Insights provides a full listing of all those components being used by your application.
For every 3rd party component, you will have access to detailed component information such as:
- Component name and description
- Used version(s)
- Its filename (i.e. physical container) (.jar, .dll, .js, etc)
- Programming language
- Obsolescence risk (see XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX)
- License risk (see XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX)
- Security risk (see XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX)
Security risk
| Info | ||
|---|---|---|
| ||
A component’s Security Risk is based on CVSS v2 Base Scores (Severities) of its vulnerabilities:
|
...
Obsolescence risk
| Info | ||
|---|---|---|
| ||
A component’s Obsolescence Risk is a measure of the risk level relative to:
Both values are combined in the Obsolescence Risk to provide a value of the risk associated to using outdated or “dead” components. |
...
License risk
| Info | ||
|---|---|---|
| ||
A component’s License Risk is a measure of the risk level relative to legal implications of used components’ licenses. |
Please visit XXXXXXXXXXXXXXXXX for further information on Licenses.
...