Cybersecurity Deep-Tier DSLs Family Index
type: language-family-index family: cybersec-deep languages_catalogued: 32 tags: [language-reference, family-index, cybersec-deep, ebpf-krsi, tetragon, falco, kql, codeql, semgrep, sentinel, lql, cosign, landlock, seccomp]
Cybersecurity Deep-Tier DSLs — Family Index
Family overview
The cybersecurity DSL landscape splits into a well-documented open-standards layer — Sigma, STIX/TAXII, OPA Rego, Cedar, OpenSCAP, MITRE ATT&CK, OSCAL — and a much larger, faster-moving operational vendor layer that the open standards have never been able to subsume. This family catalogues the vendor layer plus the deep kernel-security primitives that sit beneath it. The open-standards siblings live in identity-auth-policy, forensic-evidence and government-civictech; this note picks up where they leave off.
The most important shift in the 2020–2026 arc is the eBPF revolution at the kernel security layer. eBPF KRSI (BPF + LSM), upstreamed by Google’s KP Singh into Linux 5.7 in 2020, made it possible to attach arbitrary BPF programs to the existing 200+ LSM hook points — meaning that any security vendor could now ship runtime detection / enforcement without a kernel module and without recompiling the kernel. By 2023 more than 80% of major distros enabled BPF-LSM out of the box (AccuKnox 2024 survey), and the entire generation of products around it — Tetragon (Isovalent, now Cisco), Falco’s modern eBPF driver, Tracee (Aqua), KubeArmor — became practical to deploy. In parallel Landlock (mainline since Linux 5.13, June 2021) gave userspace its own LSM, letting unprivileged processes sandbox themselves without root; Linux 6.7 (2024) added TCP network restrictions and Linux 6.19 (Feb 2026) added shadow stack and lockdown hardening.
The second shift is the cloud-security-posture vendor DSL fragmentation problem. Wiz (acquired by Google for $32B, closed March 11 2026), Lacework (acquired by Fortinet Aug 2024, now FortiCNAPP, LQL still in active development at v26.x), Datadog Cloud Security Management, Orca, Prisma Cloud, Snyk Cloud, CrowdStrike Falcon Cloud Security — every CNAPP vendor has invented its own graph- or table-shaped query DSL over essentially the same underlying cloud-asset graph. There is no convergent standard at this layer; OPA Rego covers admission-control and IaC validation, and KQL has become a partial SIEM lingua franca, but the CSPM query surface remains balkanised.
The third shift is KQL’s quiet emergence as the SIEM lingua franca via Microsoft. The same Kusto Query Language now drives Azure Data Explorer, Azure Monitor / Log Analytics, Azure Resource Graph, Microsoft Sentinel, and Microsoft Defender XDR Advanced Hunting — and as of July 1 2026, all Sentinel UI operations migrate from the Azure portal into the Defender portal, consolidating around KQL as the single hunt-and-detect surface. KQL is cross-listed in forensic-evidence (the EQL/Sigma sibling) and graph-log-event-query; this note treats the Microsoft-stack variants (Sentinel KQL, Defender XDR Advanced Hunting, Resource Graph KQL) as a coherent family. The fourth shift is CodeQL vs Semgrep settling into complementary positions in SAST: CodeQL (2.25.4, May 2026) for deep dataflow on a smaller set of supported languages with a Datalog-style query language, and Semgrep (Multimodal launch March 2026) for fast pattern-matching across 30+ languages with a YAML/AST-pattern DSL.
In our deep library
No standalone deep-library notes exist for the vendor DSLs in this family — they are all proprietary surface languages over commercial platforms. Cross-link:
- identity-auth-policy — sibling for OPA Rego, Cedar, JWT, IAM JSON, OIDC, SCIM. Rego appears here only in its Conftest / Terraform-policy use.
- forensic-evidence — sibling for KQL (forensic context), EQL, Sigma, DFXML, CASE/UCO, plaso. KQL is cross-listed in both.
- government-civictech — sibling for STIX/TAXII, MITRE ATT&CK STIX bundle, CSAF, OSCAL.
- network-protocol-dsls — sibling for P4, Snort, Suricata, nftables, eBPF assembly / verifier-level BPF. This note covers higher-level eBPF (KRSI, Tetragon TracingPolicy, bpftrace, bcc).
- oci-cloud-native — sibling for Falco, Cilium Tetragon, Kubernetes ValidatingAdmissionPolicy / CEL, Gatekeeper. Falco and Tetragon are deliberately cross-listed in both — they sit at the K8s/runtime boundary.
- cryptography-keys — sibling for Sigstore Cosign verification policy, SLSA in-toto attestations, TUF metadata. This note links to it for image-signing policy DSLs.
- notation-spec — for formal grammars (LSM-hook policy DSLs share notational ancestry with BNF/CDDL).
- graph-log-event-query — adjacent for the graph-shaped query surfaces (Wiz, Datadog CSPM, KQL graph operators).
Tier 3 family table — Kernel-layer (eBPF / LSM / seccomp)
| Format | First appeared | Origin | Type | Status (2026) | URL |
|---|---|---|---|---|---|
| eBPF KRSI (BPF-LSM) | 2020 (Linux 5.7) | Google (KP Singh) — upstreamed 2019, merged May 2020 | BPF programs attached to LSM hook points; written in restricted C, compiled by Clang to BPF bytecode, verified at load | Active and ubiquitous — >80% of distros enable BPF-LSM out of the box by 2024 (Amazon Linux 2023, RHEL 8.5+ backport, Ubuntu, Debian, Fedora). CVE-2026-43010 (BPF kprobe.multi, fixed mainline April 15 2026) is a reminder it’s still attack surface. | https://docs.kernel.org/bpf/prog_lsm.html |
| Cilium Tetragon TracingPolicy | 2022 (Isovalent) | Cilium / Isovalent, now Cisco (acquired 2024) | CRD-driven YAML DSL declaring kprobe/tracepoint/uprobe hooks, selectors, and Post-actions (kill/block/notify). CNCF graduated sub-project of Cilium. | Active — process/file/network observability with kernel-stack and userspace-stack traces in ProcessKprobe events; the leading eBPF runtime-security CRD model. | https://tetragon.io/docs/policy-library/ |
| bpftrace | 2018 (v0.1) | Brendan Gregg + Alastair Robertson; iovisor → bpftrace org 2023 | DTrace-inspired high-level tracing DSL (awk-style); compiles to BPF bytecode via libbpf/Clang | Active, current release v0.25 (2026); the standard ad-hoc kernel tracing language for Linux | https://bpftrace.org/ |
| BCC Python BPF DSL | 2015 | iovisor (Brendan Gregg, Sasha Goldshtein) | Python frontend that embeds restricted-C BPF source, loads via libbcc/libbpf | Active but legacy-trending — libbpf-tools and CO-RE (Compile-Once Run-Everywhere) are replacing BCC’s runtime-compilation model; many flagship tools (execsnoop, biosnoop) have been rewritten in libbpf | https://github.com/iovisor/bcc |
| Falco rules YAML + Lua / plugin SDK | 2016 (Sysdig) → CNCF graduated 2024 | Sysdig / Falco Project | YAML rule files (rule, condition, output, priority) over a sysdig-style event filter expression language; plugins extend the source-table model | Active, current release v0.43.1 (April 9 2026). Legacy eBPF, gVisor, and gRPC drivers deprecated in v0.43.0; CO-RE eBPF is now the default. Falco Operator (2026) streamlines K8s deployment. | https://falco.org/docs/concepts/rules/ |
| AppArmor profiles | 2005 (mainline 2010, Linux 2.6.36) | Immunix → SUSE → Canonical → Linux mainline | Path-based MAC profile language; per-binary capability, file, network, signal rules | Active, default on Ubuntu/Debian. openSUSE Leap 16 switched to SELinux Feb 2025 — a notable shift in the SUSE camp. | https://gitlab.com/apparmor/apparmor/-/wikis/Documentation |
| SELinux policy (Reference Policy + CIL) | 2000 (NSA) → mainline Linux 2.6.0 (2003) | NSA → Tresys → community | Label-based MAC; policy written in the Reference Policy macro language compiled to CIL (Common Intermediate Language) since Linux 3.5 | Active, default on RHEL/Fedora/CentOS Stream/openSUSE 16; the gold-standard MAC with deepest type-enforcement model | https://github.com/SELinuxProject/refpolicy |
| Landlock (unprivileged LSM) | 2021 (Linux 5.13) | Mickaël Salaün (ANSSI) | Userspace syscall API + ruleset for path-based access control without root | Active and broadening — filesystem rules 5.13+, TCP network rules 6.7 (Jan 2024), shadow-stack hardening 6.19 (Feb 2026). The user-space LSM alternative to AppArmor/SELinux. | https://landlock.io/ |
| Seccomp-BPF filters | 2012 (Linux 3.5) | Will Drewry (Google ChromeOS) | Classic-BPF cBPF programs that filter syscalls; Docker/Podman/runc default profiles ship JSON renderings | Active, foundational — every container runtime, Chromium, OpenSSH, systemd, and Kubernetes uses it. Often combined with KRSI rather than replaced. | https://docs.kernel.org/userspace-api/seccomp_filter.html |
| eBPF profiling (Parca/Pyroscope) label DSLs | 2021–2022 | Polar Signals (Parca) / Grafana (Pyroscope, acquired 2022) | Prometheus-style label selector expressions over continuous-profiling samples | Active, increasingly converging with Grafana Pyroscope’s LogQL-like profile DSL | https://www.parca.dev/docs/overview/ |
Tier 3 family table — Cloud-security-posture vendor query DSLs
| Format | First appeared | Origin | Type | Status (2026) | URL |
|---|---|---|---|---|---|
| Wiz Security Graph queries (GraphQL API + Wiz Query Language) | 2020 | Wiz, Inc. (now Google Cloud, acq. closed March 11 2026 for $32B) | GraphQL API over the Wiz Security Graph; rule builder UI compiles to a graph-pattern DSL identifying “toxic combinations” | Active, now part of Google Cloud post-acquisition; Wiz Skills (RSAC 2026) expose the graph to coding-agent IDEs | https://www.wiz.io/blog/welcoming-wiz-to-google-cloud |
| Lacework FortiCNAPP LQL | 2020 | Lacework, now Fortinet (acquired Aug 1 2024 for ~$200–230M, per Forrester) | SQL-like query language for selection/filter/join over polymorphic cloud-event datasources | Active, current docs at v26.2.0 under the FortiCNAPP brand | https://docs.fortinet.com/document/forticnapp/26.2.0/lql-reference/598361/lql-overview |
| Datadog Cloud Security (CSPM) rule DSL | 2021 | Datadog | Custom-rule expression DSL over the Datadog asset graph; 1000+ built-in rules mapped to PCI/SOC2/HIPAA frameworks | Active, generally available with policy-as-code rule authoring | https://docs.datadoghq.com/security/cspm/ |
| Datadog Logs Query Language (DQL) | 2017 | Datadog | Pipe-style log query language (* + facet filters + ` | >` aggregations); separate from Datadog APM trace queries | Active |
| AWS Security Hub Insight / Finding filter | 2018 | AWS | JSON FilterCriteria and ResourceMappings over ASFF (AWS Security Finding Format) | Active, expanded with the v2 ASFF schema for cross-region/cross-account aggregation | https://docs.aws.amazon.com/securityhub/latest/userguide/asff-syntax.html |
| AWS GuardDuty FindingCriteria | 2017 | AWS | JSON filter DSL over GuardDuty findings (account/region/severity/resource conditions) | Active, extended to Runtime Monitoring eBPF-driven findings 2024–2026 | https://docs.aws.amazon.com/guardduty/latest/APIReference/API_FindingCriteria.html |
| AWS Inspector v2 / Macie / Detective JSON filters | 2021 (Inspector v2), 2017 (Macie v2), 2020 (Detective) | AWS | Service-specific JSON filter schemas; Detective uses a graph-investigation behavior model (not a user-facing DSL) | Active, low velocity in DSL evolution | https://docs.aws.amazon.com/inspector/latest/user/findings-managing-filtering.html |
| Azure Resource Graph KQL | 2018 | Microsoft Azure | KQL over the ARM resource graph (Resources, ResourceContainers, SecurityResources tables) | Active, the canonical Azure CSPM query surface | https://learn.microsoft.com/azure/governance/resource-graph/overview |
| Microsoft Defender for Cloud Apps (MCAS) policy DSL | 2015 (Adallom) → Microsoft | Microsoft (Adallom acq. 2015) | JSON / UI-driven policy conditions for SaaS posture and CASB | Active, integrated into Defender XDR | https://learn.microsoft.com/defender-cloud-apps/control-cloud-apps-with-policies |
| GCP Security Command Center filter / Finding query | 2018 | Google Cloud | CEL-flavored filter syntax over the SCC Finding schema | Active, post-Wiz acquisition expected to expand with Wiz Security Graph integration | https://cloud.google.com/security-command-center/docs/how-to-api-list-findings |
| GCP Cloud Asset Inventory CAI query | 2019 | Google Cloud | Asset/policy search filter DSL over the GCP organization’s resource state | Active | https://cloud.google.com/asset-inventory/docs/searching-resources |
Tier 3 family table — XDR / SIEM advanced-hunting
| Format | First appeared | Origin | Type | Status (2026) | URL |
|---|---|---|---|---|---|
| Microsoft Sentinel KQL | 2019 (Sentinel GA) | Microsoft, on Kusto (2014, Azure Data Explorer) | KQL over Sentinel tables; supports adx() operator to query Azure Data Explorer in-line | Active and migrating — Sentinel UI moves from Azure Portal to the Microsoft Defender portal effective July 1 2026, but the service and KQL remain | https://learn.microsoft.com/azure/sentinel/kusto-overview |
| Microsoft Defender XDR Advanced Hunting | 2018 (Microsoft 365 Defender hunting) | Microsoft | KQL over a specialised XDR schema (DeviceEvents, EmailEvents, IdentityLogonEvents, CloudAppEvents, AlertEvidence); 30-day raw retention | Active, now the unified hunting surface post-Sentinel-merge (July 2026) | https://learn.microsoft.com/defender-xdr/advanced-hunting-overview |
| CrowdStrike Falcon FQL | ~2017 | CrowdStrike | <property>:[op]<value> filter expression syntax across Falcon API service collections (Hosts, Detects, Incidents, Discover) | Active, current docs maintained via FalconPy SDK and falcon-mcp (2026 MCP server adds FQL guidance for LLM tooling) | https://www.falconpy.io/Usage/Falcon-Query-Language.html |
| CrowdStrike Humio / LogScale FQL | 2021 (Humio acq.) | Humio (Denmark) → CrowdStrike | Pipeline-style log-query DSL distinct from Falcon API FQL; functions chained by ` | ` | Active, current LogScale docs v1.240+ (April 2026) |
| Panther pypanther (Detection-as-Code) | 2024 (pypanther beta) → 2025 GA | Panther Labs | Python class-based detection rules replacing Panther’s previous YAML+Python split | Active, the modern Python-native Detection-as-Code reference | https://docs.panther.com/detections/rules/python |
| Snowflake row-access policies / Detection-as-Code on Snowflake | 2022 (Anvilogic, Hunters, Panther-on-Snowflake) | Anvilogic / Hunters / Panther / community | SQL row-access policies + Snowflake-resident detection rules; cross-listed in sql for the warehouse-as-SIEM pattern | Active, a recognisable architecture pattern in 2025–2026 SIEM modernisation | https://docs.snowflake.com/en/user-guide/security-row-intro |
Tier 3 family table — Code / supply-chain SAST + SCA
| Format | First appeared | Origin | Type | Status (2026) | URL |
|---|---|---|---|---|---|
| CodeQL | 2014 (Semmle QL) → 2019 (GitHub acq.) | Semmle (Oxford spinout, Oege de Moor) → GitHub | Datalog-derived object-oriented query language; queries compiled against a code database (relational AST + dataflow + CFG) | Active, v2.25.4 (May 12 2026) adds Swift 6.3.1, models-as-data sanitizers and validators, Vercel serverless analysis. The 2026 Semantic Delta Engine cuts PR scan time ~80% via incremental analysis. | https://codeql.github.com/docs/ |
| Semgrep rules YAML | 2017 (r2c) → 2020 OSS | r2c → Semgrep, Inc. | YAML rules with pattern / pattern-not / pattern-either AST-pattern syntax over Tree-sitter-derived ASTs; 30+ languages | Very active, Semgrep Multimodal launched March 2026 pairing rule-based analysis with LLM reasoning for IDOR/AuthZ detection | https://semgrep.dev/docs/writing-rules/overview |
| Joern CPG query (Scala / Ocular) | 2014 (shiftleft / TU Darmstadt) | Fabian Yamaguchi et al. | Gremlin-style traversal over a Code Property Graph (AST + CFG + PDG); Scala DSL | Active, maintained by Qwiet AI (formerly ShiftLeft) | https://docs.joern.io/ |
| Trivy policy + Rego checks | 2019 (Vad Krasil → Aqua acq. 2020) | Aqua Security | YAML + embedded Rego policies for SCA/IaC/misconfig scanning; SBOM generation in CycloneDX/SPDX | Active, v0.70.0 (April 17 2026) — note Trivy GitHub Action compromised twice March 2026 (TeamPCP supply-chain campaign), pin by commit SHA | https://aquasecurity.github.io/trivy/ |
| Grype / Syft (Anchore) + Grant policy | 2020 (Syft) / 2020 (Grype) / 2024 (Grant) | Anchore | SBOM generation (Syft, SPDX/CycloneDX), vuln matching (Grype), license-policy enforcement (Grant — Rego or builtin DSL) | Active | https://github.com/anchore/grype |
| GitGuardian / TruffleHog secret-detection rules | 2018 (TruffleHog) / 2017 (GitGuardian) | Dylan Ayrey (TruffleHog) / GitGuardian | Regex + entropy + provider-specific validator detector definitions (YAML / Go-coded detectors) | Active, TruffleHog v3 (Go rewrite) and GitGuardian’s signed-validators ecosystem are the de facto standards | https://github.com/trufflesecurity/trufflehog |
Tier 3 family table — Policy-as-code (vendor / TF / supply chain)
| Format | First appeared | Origin | Type | Status (2026) | URL |
|---|---|---|---|---|---|
| HashiCorp Sentinel | 2017 | HashiCorp (now IBM, acq. April 2024 → closed Feb 2025) | Embedded policy-as-code DSL; advisory/soft-mandatory/hard-mandatory enforcement levels in Terraform Cloud/Enterprise, Vault, Consul, Nomad | Active, pre-written AWS Sentinel policy sets reached GA in 2025; remains the canonical Terraform policy DSL alongside OPA Rego | https://docs.hashicorp.com/sentinel |
| OPA Rego (Conftest variant for TF / K8s manifests) | 2018 (Conftest, Gareth Rushgrove) | Styra / CNCF Open Policy Agent | Rego (declarative Datalog-derived) applied to CI artifacts: Terraform plan JSON, K8s YAML, Dockerfile. Rego itself catalogued in identity-auth-policy. | Active, OPA graduated CNCF 2021; Conftest is the standard “Rego over arbitrary YAML/JSON” CI gate | https://www.conftest.dev/ |
Sigstore Cosign verification policy (ClusterImagePolicy / cosign verify --policy) | 2022 | Sigstore (Linux Foundation, OpenSSF) | YAML ClusterImagePolicy in Sigstore Policy Controller; Cosign verifies in-toto attestations against CUE or Rego policies | Active, central to SLSA L3+ enforcement; Cosign supports npm Provenance, GitHub Artifact Attestations, Homebrew Provenance verification (2024–2026) | https://docs.sigstore.dev/policy-controller/overview/ |
| Tekton Chains attestation policy | 2021 | Tekton (CD Foundation) | In-toto SLSA provenance generated by Tekton Chains; verified by Cosign + Policy Controller | Active, the canonical SLSA-in-Tekton story | https://tekton.dev/docs/chains/ |
Total catalogued: 32 formats across kernel layer (10), CSPM vendor (10), XDR/SIEM (6), SAST/SCA (6) — with Sentinel/Conftest/Cosign/Tekton Chains as the policy-as-code coda.
Notable threads
-
eBPF KRSI is now the kernel-security primitive of record. Five years after the May 2020 mainline merge, BPF-LSM is the default-on substrate for cloud workloads: Amazon Linux 2023, RHEL 8.5+ (backport), Fedora, Ubuntu, Debian, EKS — and underpins every modern runtime security tool that isn’t still hauling a kernel module around (Tetragon, Falco’s modern driver, Tracee, KubeArmor). The 2026 CVE-2026-43010 reminder (BPF kprobe.multi, mainline-fixed April 15 2026) shows the verifier itself is now part of the kernel attack surface that auditors scrutinise. The displacement of AppArmor/SELinux is not happening — they remain the default MAC layer on their respective distros — but new vendor enforcement is universally being built as BPF-LSM programs rather than as new LSM modules.
-
The CSPM vendor-DSL fragmentation problem has only intensified post-consolidation. Wiz → Google (200–230M, Aug 2024) reduced the vendor count without unifying the languages — Wiz’s Security Graph (GraphQL + WQL) and Lacework’s LQL (SQL-like) remain distinct and incompatible, and Google has signalled the Wiz Skills surface (RSAC 2026) will be exposed to coding agents as a brand, not collapsed into Security Command Center’s CEL filters. There is no convergent industry standard at the CSPM-query layer in 2026, and the Datadog/Orca/Prisma/Snyk camp shows no sign of converging on one. OCSF (Open Cybersecurity Schema Framework, Splunk/AWS, 2022) helps at the schema layer but does nothing at the query-DSL layer.
-
KQL has quietly become the SIEM lingua franca via Microsoft’s full-stack consolidation. The July 1 2026 Sentinel UI migration into the Microsoft Defender portal is the punctuation mark — Sentinel + Defender XDR + Azure Resource Graph + Azure Monitor all share the same KQL surface, the same Kusto engine class, and increasingly the same schema (DeviceEvents, AlertEvidence, CloudAppEvents). The competitive answer from Google (Chronicle UDM / YARA-L 2.0), AWS (Security Hub finding filters + Athena/OpenSearch), and Splunk (SPL2) does not have the same gravitational pull on third-party detection content: GitHub repos of “KQL for hunting” outnumber every other XDR-DSL community by an order of magnitude (cyb3rmik3/KQL-threat-hunting-queries and similar). Sigma remains the cross-vendor abstraction but is mostly used as a transpilation source into KQL/Splunk SPL/Elastic EQL.
-
CodeQL vs Semgrep have settled into complementary positions, not a winner-take-all. CodeQL (Semmle / GitHub, Datalog-derived QL) does deep interprocedural dataflow on a fixed set of supported languages — Swift 6.3.1 added in 2.25.4 (May 2026), models-as-data sanitizers and validators across C/C++/C#/Go/Java/Kotlin/JS/TS/Python/Ruby/Rust, and the 2026 Semantic Delta Engine cuts PR scan time ~80%. Semgrep (r2c, YAML AST-pattern DSL) trades depth for breadth — 30+ languages, faster authoring, and the March 2026 Multimodal launch pairs the deterministic engine with LLM reasoning for IDOR/AuthZ detection that pure pattern-matching misses. CodeQL ships free for OSS and is paid for private repos via GHAS; Semgrep CE is open-source under a non-OSI Semgrep Rules License (Polyform-derived). Both languages remain catalogued at the deep-tier rather than promoted because their query semantics are too vendor-specific to abstract.
-
HashiCorp Sentinel still matters in Terraform policy enforcement, post-IBM acquisition. IBM closed the HashiCorp acquisition in February 2025, and Sentinel retained both its language and its market position — pre-written AWS Sentinel policy sets reached GA in 2025, and Sentinel remains the only policy DSL with a tight, multi-product integration across Terraform Cloud/Enterprise, Vault, Consul, and Nomad with three enforcement levels (advisory / soft-mandatory / hard-mandatory). OPA Rego via Conftest is the open-source alternative and dominates the K8s-admission and CI-gate territory; the two coexist by audience (Sentinel for HCP customers, Rego/Conftest for CNCF stacks). Real-world Terraform shops increasingly run both — Sentinel on TFE, Rego/Conftest on the same plan-JSON in CI.
-
Landlock is the underappreciated user-space LSM story. Mickaël Salaün’s Landlock (ANSSI, mainlined Linux 5.13 in 2021) lets unprivileged processes sandbox themselves via a syscall-driven ruleset — no SELinux policy compilation, no AppArmor profile path, no root. Filesystem rules shipped in 5.13, TCP network restrictions in 6.7 (Jan 2024), and Linux 6.19 (Feb 2026) added shadow-stack hardening and lockdown-mode tightening. As Chromium, systemd, and OpenSSH adopt Landlock fences, the model — sandbox-yourself rather than be-sandboxed-by-admin — increasingly competes with seccomp-BPF for the same role. The DSL is shallow (a syscall struct API, not a textual language), but it belongs in this family as the modern complement to AppArmor/SELinux MAC profiles.
-
Sigstore / Cosign verification policy is the supply-chain convergence point. SLSA L3+ now requires verifiable in-toto attestations, and Cosign’s verification surface —
ClusterImagePolicyYAML, CUE policies, Rego policies invoked bycosign verify --policy— is the convergent answer. Cosign’s 2024–2026 expansion to verify npm Provenance, GitHub Artifact Attestations, and Homebrew Provenance signed bundles cements it as the cross-ecosystem verification verb. Cross-link: cryptography-keys covers the underlying key-and-attestation formats; this family covers the policy surface that consumes them.
Citations
- eBPF KRSI / BPF-LSM kernel docs: https://docs.kernel.org/bpf/prog_lsm.html
- LWN “KRSI — the other BPF security module” (Corbet, 2020): https://lwn.net/Articles/808048/
- AccuKnox BPF-LSM distro adoption survey (cited 2024): https://accuknox.com/blog/runtime-security-ebpf-bpf-lsm
- Cilium Tetragon docs: https://tetragon.io/docs/
- bpftrace project: https://bpftrace.org/ ; v0.25 release notes: https://github.com/bpftrace/bpftrace/releases
- iovisor BCC: https://github.com/iovisor/bcc
- Falco rules + v0.43.x changelog: https://github.com/falcosecurity/falco/blob/master/CHANGELOG.md ; Falco docs: https://falco.org/docs/
- Landlock project + kernel docs: https://landlock.io/ , https://docs.kernel.org/userspace-api/landlock.html
- AppArmor wiki: https://gitlab.com/apparmor/apparmor/-/wikis/Documentation
- SELinux Reference Policy: https://github.com/SELinuxProject/refpolicy
- Seccomp filter docs: https://docs.kernel.org/userspace-api/seccomp_filter.html
- Wiz acquisition closing announcement (March 11 2026): https://www.googlecloudpresscorner.com/2026-03-11-Google-Completes-Acquisition-of-Wiz
- Lacework FortiCNAPP LQL Reference (v26.2.0): https://docs.fortinet.com/document/forticnapp/26.2.0/lql-reference/598361/lql-overview
- Datadog Cloud Security Management: https://docs.datadoghq.com/security/cloud_security_management/
- AWS Security Hub ASFF syntax: https://docs.aws.amazon.com/securityhub/latest/userguide/asff-syntax.html
- AWS GuardDuty FindingCriteria: https://docs.aws.amazon.com/guardduty/latest/APIReference/API_FindingCriteria.html
- Azure Resource Graph: https://learn.microsoft.com/azure/governance/resource-graph/overview
- Microsoft Sentinel + Defender XDR Advanced Hunting (KQL): https://learn.microsoft.com/defender-xdr/advanced-hunting-microsoft-defender
- Sentinel-into-Defender migration July 1 2026: https://learn.microsoft.com/azure/sentinel/microsoft-sentinel-defender-portal
- CrowdStrike Falcon FQL: https://www.falconpy.io/Usage/Falcon-Query-Language.html
- CrowdStrike LogScale (Humio) query syntax: https://library.humio.com/data-analysis/syntax.html
- Panther pypanther: https://panther.com/blog/introducing-pypanther-the-future-of-code-driven-detection-and-response
- CodeQL docs + 2.25.4 changelog (May 12 2026): https://codeql.github.com/docs/ , https://github.blog/changelog/2026-05-12-codeql-2-25-4-adds-swift-6-3-1-support-improvements-to-c-and-java-and-more/
- Semgrep Multimodal launch (March 2026): https://semgrep.dev/docs/release-notes/march-2026
- Trivy v0.70.0 + supply-chain incident note: https://github.com/aquasecurity/trivy/releases
- Anchore Grype/Syft/Grant: https://github.com/anchore/grype
- TruffleHog: https://github.com/trufflesecurity/trufflehog
- HashiCorp Sentinel docs: https://docs.hashicorp.com/sentinel
- OPA Conftest: https://www.conftest.dev/
- Sigstore Cosign verification + Policy Controller: https://docs.sigstore.dev/policy-controller/overview/
- Sigstore Cosign bundle verification (npm/GitHub/Homebrew, 2024–2026): https://blog.sigstore.dev/cosign-verify-bundles/
- Tekton Chains: https://tekton.dev/docs/chains/