Bill of Behavior Bill of Behavior

An open standard, in development

Software Bill of Behavior

The runtime companion to the Software Bill of Materials. Vendor-neutral, machine-checkable, designed for EU Cyber Resilience Act and NIS 2 readiness.

  • prescriptive behavior
  • deterministic (no AI)
  • made for CRA & NIS 2
The standard Contribute
bob § Bill of Behavior — registered

The standard

What SBOB is

SBOBs prescribe the intended benign behavior of the software. SBOMs describe what is in the software. The Bill of Behavior prescribes what the software is intended to do at runtime — expressing intent in the form of signed yaml profiles, suitable for detection engineering, verifcation of exposure and compliance regimes (EU Cyber Resilience Act, NIS 2, DORA).

The vendor declares the behavior in a prescriptive manner. The end user verifies it. Defenders get up-to-date detection rules with every release.

Until such a time, that vendors actually do this, you can create your own SBOB or use the ones provided by the community.

Where things live today

See it in action

SBOB as contrast

The animation walks a Redis kill-chain and shows how each step is covered by the Kubescape detection rules the SBOB generates — the attacks are generated by AI from real CVEs and attack types of the last decade.

Redis kill-chain — each attack step mapped to the Kubescape rule coverage generated from the Redis SBoB
A Redis kill-chain vs. the Kubescape rule coverage derived from its SBoB. Source: k8sstormcenter/bob · example/redis-client.

Reproduce the contrast with bobctl:

bobctl contrast --profile example/redis-client/sbobs/ap-redis.yaml \
  --type database --expect reads-host-files --strict

Stay in the loop

Get notified when SBOBs are released

Community supplied SBOBs will be released periodically. Leave your email to be notified.

Stewardship and FAQ

An open standard

Bill of Behavior is a free and open-source standard. It is not a product. Any interpreter can implement it, the usage of eBPF is strongly encouraged.

FAQ

  1. Does the SBOB replace Linux Security Modules? NO - please use LSMs as you always did. SBOB is an addition
  2. Does the SBOB replace SBOMs? NO - they solve entirely different problems. Please use SBOMs!
  3. Can I create an SBOB in CI? Not entirely, automation gives you a base, but `intent` can only be defined by humans.
  4. Can I test an SBOB in CI? Yes, that is one use-case
  5. Can I use an SBOB to detect malicious behavior? Yes, that is one of the main use-cases
  6. Does the SBOB replace my SIEM, EDR etc.? NO - SBOB is designed to work alongside these.
  7. Can SBOB be used in enforcing mode? Not fully yet, only network policies are supported in enforcing mode.

Contribute

Get involved

The standard is open and currently implemented by the Kubescape community. We have an active backlog. The most useful way to contribute is twofold:

  1. Join the Kubescape community and help test, open issues or contribute to streamlining the existing features. Easiest is to talk to us on the CNCF Slack channel #kubescape-dev
  2. Work with us on a specific CNCF project to convert its functional and security tests into a robust SBoB profile.
    3. github.com/k8sstormcenter/bob