Technical Articles

This section covers foundational knowledge, operational practices, and related security technologies.

• August 23, 2026 — CVE Basics and the Publication Process — what a CVE ID represents, how the CVE Program is organized, and the process from vulnerability reporting to publication
• August 27, 2026 — KEV Catalog Basics and Usage — what the KEV Catalog is, what qualifies a vulnerability for inclusion, what data the catalog provides, and how to use it to prioritize remediation
• August 30, 2026 — EPSS Basics and How to Check Scores — what EPSS measures, how to interpret and retrieve scores, how the model works, and how to use EPSS in vulnerability management
• September 8, 2026 — CVSS Basics and the Scoring and Publication Process — what CVSS measures, how assessments are scored and published, and how to check scores and vector strings in NVD
• September 10, 2026 — Trivy Basics and How to Read Scan Results — what Trivy scans, how to read its JSON output, and considerations when using scan results for vulnerability management
• September 13, 2026 — How to Map Running Container Processes to OS Packages with procfs — how to find a container's host PIDs, read exe, maps, status and sockets under /proc, resolve paths to dpkg, apk and distroless packages, and the pitfalls and permission checks measured on real images
• September 16, 2026 — How to Check Runtime Usage of Packages Reported by Container Vulnerability Scans — validation of matching observed files to scan findings, limited ground-truth comparisons, detection and mapping limitations, and unevaluated coverage
• September 17, 2026 — Reading Process Information Without Root Using Linux Capabilities — the roles of CAP_SYS_PTRACE and CAP_DAC_READ_SEARCH, ptrace access checks and file permissions, measured permission conditions, and the collector used for the measurements
• September 18, 2026 — Understanding and Checking Trivy Status Values — Status versus FixedVersion, actual scan records, data-source differences, filtering, and remediation decisions
• September 19, 2026 — Observing Container Execution and File Opens with bpftrace — the programs used for measurement, tracepoints and cgroup attribution, short-lived execution capture, observation timing, and lost records
• September 20, 2026 — Mapping Language Packages Detected by Trivy to Runtime Files — package detection and file mapping for Python, Node.js, Java, and Go, measured results by method, observation timing, and evidence granularity
• October 5, 2026 — Interactive Guide to the bpftrace Measurement Workflow — one curl run in nine steps, E/O/X output lines, open entry/exit pairing, container attribution, and conversion to JSONL
• October 5, 2026 — Interactive Guide to the procfs Package Mapping Workflow — one nginx worker in eight steps, path extraction from maps, package ownership and version lookup with dpkg, Trivy matching, and confirmation of loading