SecObserve
Overview · Integrations · Quickstart · Documentation · Code of Conduct · Contributing · License · Community projects · Funding
SecObserve is an open source vulnerability and license management system for software development teams and cloud environments. It supports a variety of open source vulnerability scanners and integrates easily into CI/CD pipelines. Results about potential security flaws from various vulnerability scanning tools are made available for assessment and reporting.
Overview
The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. It consists of 2 major components:
- Vulnerability and license management system SecObserve: SecObserve provides the development team with an overview of the results of all vulnerability and license scans for their project, which can be easily filtered and sorted. In the detailed view, the results are displayed uniformly with a wealth of information, regardless of which vulnerability scanner generated them.
- GitLab CI templates and GitHub actions: Integrating vulnerability scanners into a CI/CD pipeline can be tedious. Each tool has to be installed differently and is called with different parameters. To avoid having to solve this task all over again, there are repositories with GitLab CI Templates and GitHub Actions. These make the process of integrating vulnerability scanners very simple by providing uniform methods for launching the tools and uniform parameters. The tools are regularly updated in the repositories so that the latest features and bug fixes are always available.
The sources of the GitHub actions and GitLab CI templates can be found in https://github.com/SecObserve/secobserve_actions_templates.
Integrations
Quickstart
git clone [email protected]:SecObserve/SecObserve.git
cd SecObserve
cp frontend/.env.no_oidc frontend/.env
./bin/dev.sh- User interface:
- User / password:
admin/admin
Documentation
The full documentation how to install and use SecObserve can be found here: https://secobserve.github.io/SecObserve/
Code of Conduct
Please note that this project is released with a Code of Conduct. By participating in this project you agree to abide by its terms.
Contributing
Please see the Contributing Guidelines for more information on how to get involved in the project.
License
SecObserve is licensed under the 3-Clause BSD License
Community projects
- MCP server: secobserve-mcp exposes the SecObserve REST API to an LLM agent over the Model Context Protocol: browse and triage observations, manage products, branches and rules, import scan reports and SBOMs, run scans and background jobs, generate VEX documents.
- Terraform provider: SecObserve Provider manages configuration of a SecObserve instance: products, product groups, branches, services, memberships, authorization groups, rules, API import configurations and license policies.
Funding
https://nlnet.nl/project/SecObservePlus
This project is funded through the NGI0 Commons Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 101135429. Additional funding is made available by the Swiss State Secretariat for Education, Research and Innovation (SERI).