[Suggestion] Trying to understand the criterion for tools in Security Assurance

[JasonKeirstead]

I am trying to understand the criterion for the tools in these various pages.

I will focus on one example, Threat intelligence: ( https://github.com/cncf/tag-security/blob/cnsmap/content/threat-intelligence.md )

The page does not really describe in detail the threat intelligence space. The links are a bit of a grab bag of TIPs, sharing tools, and data feeds. Also,1 of the links is to something that is not open source, it is commercial (ThreatCrowd). Yes it is free, but there are a lot of other commercial providers that provide free threat intel that could be added here. Can/should they be? Also should this page go into more detail on how to use threat intelligence?

I am happy to contirbute to fleshing out this page more. Just trying to understand the goal first before stepping on toes with a gigantic PR.

I have similar feedback for all of the pages under the "Security Assurance" area (which is my balewick & why I am focusing on that one)

[lumjjb]

Hey @JasonKeirstead Thanks for your comments.

The general guiding principles for projects we've detailed around in https://github.com/cncf/tag-security/tree/main/security-whitepaper/cnsmap#project-listings. Our general rule favors CNCF and opensource, but in areas where there is a lacking, we include other free or commercial tools for completeness.

I am happy to contirbute to fleshing out this page more. Just trying to understand the goal first before stepping on toes with a gigantic PR.

That would be awesome - as you can tell, the level of detail very much depends on what our contributors are experts in, in this case, it would be awesome if you can help bolster up these topics!

[JasonKeirstead]

Thanks, I will submit a PR shortly

[lumjjb]

Hi @JasonKeirstead, how's it going on this issue!

[stale[bot]]

This issue has been automatically marked as inactive because it has not had recent activity.

[lumjjb]

Hey @JasonKeirstead! How's it going - just pinging back on this.

[stale[bot]]

This issue has been automatically marked as inactive because it has not had recent activity.

[anvega]

@JasonKeirstead, thanks for bringing attention to the issue. Agree with you that the substance in that section you point out needs to be improved. We'd appreciate it if you could still get around the PR to raise the integrity and relevance of the paper. For now, I'll close the issue and await the PR.