DSO Knowledge Base — 3,163 DevSecOps Documents

DSO Knowledge Base — 3,163 DevSecOps Documents

Challenge

Security practitioners need quick access to tool guidance, best practices, and framework mappings. Information is scattered across vendor docs, GitHub READMEs, and blog posts. There’s no unified, queryable knowledge base that covers the full DevSecOps lifecycle.

Build a comprehensive knowledge base that:

  • Covers all security functions (NIST CSF 2.0)
  • Is queryable by AI agents (Claude Code integration)
  • Maintains source traceability
  • Supports both human browsing and programmatic access

Solution Architecture

NIST CSF 2.0 Organization

DSO Knowledge Base
├── 00-governance/      (126 docs) — Policy, GRC, compliance
├── 01-identify/        (77 docs)  — Asset discovery, threat intel
├── 02-protect/         (631 docs) — AppSec, container security
├── 03-detect/          (130 docs) — Detection engineering, SIEM
├── 04-respond/         (74 docs)  — Incident response, forensics
├── 05-recover/         (46 docs)  — Disaster recovery, BCP
├── 06-implement/       (118 docs) — Secure SDLC, gates
├── 07-platform/        (191 docs) — Infrastructure hardening
├── 08-offensive/       (106 docs) — Red team, adversary emulation
├── 09-automation/      (143 docs) — GitOps, agent orchestration
├── 10-compliance/      (61 docs)  — OSCAL, SOC CMM, kube-bench
└── 11-96: Supporting domains (algorithms, ML, finance, etc.)

Document Structure

Each document follows a consistent format:

# Tool/Concept Name

## Overview
Brief description and primary use case.

## Key Features
- Feature 1: Description
- Feature 2: Description

## Use Cases
- Use case 1
- Use case 2

## Integration Points
How it connects with other tools/frameworks.

## References
- Official docs link
- GitHub repository
- Related KB documents

Key Categories

Security Operations (NIST CSF Core)

FunctionDocsKey Topics
Govern126Policy-as-code, OPA, OSCAL, GRC platforms
Identify77Asset inventory (NetBox, Fleet), OSINT, threat intel (MISP)
Protect631AppSec, SAST/DAST, container security (Falco, Trivy), supply chain
Detect130Sigma rules, Wazuh, Suricata, threat hunting (Hayabusa)
Respond74DFIR (Velociraptor), incident management, forensics
Recover46DR automation (Velero), business continuity

Implementation & Platform

CategoryDocsKey Topics
Implement118OWASP SAMM, security gates, progressive delivery
Platform191CIS benchmarks, Kubernetes hardening, cloud security
Offensive106Atomic Red Team, MITRE Caldera, adversary emulation
Automation143LangGraph, CrewAI, ArgoCD, GitOps patterns
Compliance61OSCAL, SOC-CMM, kube-bench, compliance automation

Supporting Domains

RangeCategoriesExamples
11-40CS FundamentalsData structures, algorithms, complexity
41-70Science/EngineeringPhysics, chemistry, materials, aerospace
71-87Applied DomainsHealth, sports, economics, marketing
88-98AI/ML & LLMAI security, agents, RAG, prompt engineering
99Software EngineeringDesign patterns, architecture, testing
100-101Linux & KubernetesSystem administration, container orchestration

Agent Integration

Claude Code Query Interface

# User-invocable skill
/kb <query>

# Example queries
/kb "Sigma rule authoring best practices"
/kb "Container runtime security Falco vs Tetragon"
/kb "DORA compliance automation"

# Search by category
grep -r "Falco\|Tetragon" 03-detect/

# Find tool-specific guidance
find . -name "*.md" -exec grep -l "ArgoCD" {} \;

# Search across framework
grep -r "OSCAL\|SOC-CMM" .

Key Reference Documents

Priority Reading (Cross-Cutting)

DocumentTopic
02-protect/0302AI/ML security tools (Promptfoo, MITRE ATLAS)
02-protect/0310Container runtime (Falco, Tetragon, Trivy)
03-detect/0307Detection engineering (Sigma, Hayabusa)
04-respond/0308DFIR platforms (Velociraptor, DFIR-IRIS)
06-implement/0312Secure SDLC (OWASP SAMM, Flagger)
09-automation/0303Agent orchestration (LangGraph, CrewAI)
10-compliance/0314Compliance automation (OSCAL, SOC-CMM)

Results & Benefits

Coverage Metrics

Total Documents: 3,163
├── Security Operations: ~1,200 docs
├── Implementation/Platform: ~500 docs
├── Supporting Domains: ~1,400 docs
└── Cross-References: 5,000+ internal links

Use Cases

  1. Security Architecture: Quick reference for tool selection
  2. Incident Response: Runbook and procedure lookup
  3. Compliance: Control mapping and evidence guidance
  4. AI Agents: Claude Code knowledge grounding
  5. Training: Onboarding material for security teams

Maintenance

Update Cadence

  • Weekly: New tool summaries from GitHub trending
  • Monthly: Framework updates (NIST, CIS, OWASP)
  • Quarterly: Comprehensive review and gap analysis

Quality Gates

  • Source traceability (GitHub refs)
  • Cross-reference validation
  • NIST CSF mapping verification
  • Broken link detection