SysAuditor  Implementation

SysAuditor environment and requirements (Collection Tool)

• The SysAuditor is compatible with any Linux based computer. 

• The executable is .... in size.

•  The executable is manually run.

• Generated files are tagged by name, date and time with path designation.

• The SPDX 3.1 format is used creation.

• JASON-LD is the link encoding method.

• DOT graphic viewer is used to review the BOMs.

What bill of materials does SysAuditor generate?

The SysAuditor takes all identified system information categorizes the information based on the existing SPDX 3.1 format to create a single file.

This file includes the following component categories:

• Core: foundational concepts common to all profiles

• Hardware: all component with related hardware and software tree structures including physical and virtual environments

• Software: concepts related to software artifacts

• Licensing: license information necessary for compliance with typical licensing use cases

A SysAuditor file can be enriched with additional SPDX BOM information such as (but not limited to):

• Security: security-related metadata specific to a piece of software

• Build: information required to describe an instance of a software build

• AI: concepts and data elements related to an AI system and model

• Dataset: concepts related to a dataset, including preparation process, characteristics, and access methods

• 
  

SysAuditor Installation Procedure

There are several distinct phases to the SysAuditor installation and operation:

1. Installation and execution on each computer system.

2. Collection and viewing of computer data.

3. Data amalgamation and review.

4. Data analysis

Installation and execution per computer.

Collection and viewing of computer data.

• The generated JASON-LD file will be XXXmbits in size. 

• The file name is autogenerated using "systeminformation/data/time"

• A storage path is designated.

• DOT viewer is used for visual presentation and review. 

• Files are machine readable.

Data amalgamation, enrichment and review.

• Files can be amalgamated based on the SPDX form for the creating and review of a system environment. Individual system identification and related information is maintained.

• Additional information can be added to a system files to create an enriched file for analysis. Enriched files help to mitigate risk.

• 
  

Data analysis

Data Search or Filtering

Bundle  -  composite

What is my resource

Operational profile

Merging graphs - Template binding process - real time run and back end process is a template bind process - link to graph node

Dependency tree does not reside in 1 dat set 

• power

• cooling

• software