D2.8 Runtime Evidence Extractor – v1

Deliverable D2.8 Runtime Evidence Extractor – v1 Editor(s): Angelika Schneider, Florian Wendland Responsible Partner: Fraunhofer AISEC (FHG) Status-Version: Final v1.0 Date: 31.10.2024 Type: OTHER Distribution level: PU D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 2 of 23 www.emerald-he.eu Project Number: 101120688 Project Title: EMERALD Title of Deliverable: D2.8 – Runtime Evidence Extractors – v1 Due Date of Delivery to the EC 31.10.2024 Workpackage responsible for the Deliverable: WP2 – Methodology for knowledge extraction Editor(s): Angelika Schneider (FHG), Florian Wendland (FHG) Contributor(s): - Reviewer(s): Verena Geist (SCCH) Cristina Martínez, Juncal Alonso (TECNALIA) Approved by: All Partners Recommended/mandatory readers: WP1, WP2, WP3, WP4, and WP5 Abstract: This deliverable presents a tool for evidence extraction from runtime information that can be integrated with the certification graph. It is the result of work performed in Task 2.5. This document is a first/interim version, the final version on runtime evidence extractors will be reported in D2.9. Keyword List: Evidence collection, runtime information, cloud, Clouditor-Discovery, technical evidence. Licensing information: This work is licensed under Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0 DEED https://creativecommons.org/licenses/by-sa/4.0/) Disclaimer Funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union. The European Union cannot be held responsible for them. D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 3 of 23 www.emerald-he.eu Document Description Version Date Modifications Introduced Modification Reason Modified by v0.1 09.09.2024 First draft version, ToC, executive summary, about this deliverable Angelika Schneider (FHG) v0.2 23.09.2024 Limitations and future work, prototype architecture, functional description Angelika Schneider (FHG) v0.3 24.09.2024 Functional description, document structure, appendices prepared Angelika Schneider (FHG) v0.4 25.09.2024 Component card Clouditor-Discovery Angelika Schneider (FHG) v0.5 27.09.2024 Renaming in-toto, add discovery component flags image, incorporating comments from Christian Banse. Angelika Schneider (FHG) v0.6 07.10.2024 Description of Codyze-Provenance Florian Wendland (FHG) v0.7 07.10.2024 Delete appendix, add conclusion Angelika Schneider (FHG) v0.8 08.10.2024 Finalizing document for the internal review Angelika Schneider (FHG) v0.9 14.10.2024 Internal QA review Verena Geist (SCCH) v0.10 16.10.2024 Incorporate QA review comments Angelika Schneider (FHG) v0.11 18.10.2024 Incorporate QA review comments Florian Wendland, Angelika Schneider (FHG) v0.12 28.10.2024 Final review Cristina Martínez/ Juncal Alonso (TECNALIA) v0.13 29.10.2024 Incorporate final review comments Florian Wendland, Angelika Schneider (FHG) v1.0 31.10.2024 Submitted to the European Commission Cristina Martínez/ Juncal Alonso (TECNALIA) D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 4 of 23 www.emerald-he.eu Table of contents Terms and abbreviations ............................................................................................................... 6 Executive Summary ....................................................................................................................... 7 1 Introduction ........................................................................................................................... 8 1.1 About this deliverable .................................................................................................... 8 1.2 Document structure ....................................................................................................... 8 2 Runtime evidence extractors in the EMERALD architecture ............................................... 10 3 Clouditor-Discovery ............................................................................................................. 12 3.1 Functional description ................................................................................................. 12 3.2 Technical description ................................................................................................... 13 3.2.1 Prototype architecture ...................................................................................... 13 3.2.2 Technical specifications ..................................................................................... 14 3.3 Delivery and usage ....................................................................................................... 15 3.3.1 Package information .......................................................................................... 15 3.3.2 Installation ......................................................................................................... 15 3.3.3 Instructions for use ............................................................................................ 16 3.3.4 Licensing information ........................................................................................ 18 3.3.5 Download .......................................................................................................... 18 3.4 Limitations and future work ........................................................................................ 18 4 Codyze-Provenance ............................................................................................................. 19 4.1 Functional description ................................................................................................. 19 4.2 Technical description ................................................................................................... 20 4.2.1 Prototype architecture ...................................................................................... 20 4.2.2 Technical specifications ..................................................................................... 20 4.3 Delivery and usage ....................................................................................................... 20 4.3.1 Package information .......................................................................................... 20 4.3.2 Installation ......................................................................................................... 20 4.3.3 Instructions for use ............................................................................................ 21 4.3.4 Licensing information ........................................................................................ 21 4.3.5 Download .......................................................................................................... 21 4.4 Limitations and future work ........................................................................................ 21 5 Conclusions .......................................................................................................................... 22 6 References ........................................................................................................................... 23 D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 5 of 23 www.emerald-he.eu List of tables TABLE 1. REQUIREMENT CLDISC.01 - DISCOVERY OF SECURITY FEATURES OF INFRASTRUCTURE COMPONENTS 13 TABLE 2. OVERVIEW OF THE IMPORTANT API FUNCTIONS FOR THE CLOUDITOR-DISCOVERY ......................... 14 TABLE 3. OVERVIEW OF THE PACKAGE STRUCTURE OF CLOUDITOR-DISCOVERY. .......................................... 15 TABLE 4. OVERVIEW OF TENTATIVE PACKAGE STRUCTURE FOR CODYZE-PROVENANCE ................................. 20 List of figures FIGURE 1. EXCERPT OF THE EMERALD COMPONENT DIAGRAM [8]. THE HIGHLIGHTED COMPONENT CLOUDITORDISCOVERY AND THE COMPONENT CODYZE-PROVENANCE, WHICH IS PART OF THE CODYZE COMPONENT, ARE DESCRIBED IN THIS DELIVERABLE. .......................................................................................... 11 FIGURE 2. OVERVIEW OF THE AVAILABLE OPTIONS FOR CLOUDITOR-DISCOVERY ......................................... 16 FIGURE 3. EMERALD UI VIEW FOR SETTING THE EVIDENCE COLLECTORS FOR A CERTIFICATION TARGET (D4.3 [13]) ..................................................................................................................................... 17 FIGURE 4. EMERALD UI VIEW FOR THE AVAILABLE FUNCTIONALITIES OF AN EVIDENCE COLLECTOR (D4.3 [13]) ............................................................................................................................................. 17 D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 6 of 23 www.emerald-he.eu Terms and abbreviations AI Artificial Intelligence AI-SEC AI Security Evidence Collector AMOE Assessment and Management of Organisational Evidence API Application Programming Interface AWS Amazon Web Services CertGraph Certification Graph CI/CD Continuous Integration / Continuous Deployment CLI command-line interface Codyze Static Code Analyzer from FHG CSAF Common Security Advisory Framework CSP Cloud Service Provider eknows Platform for Software Analysis from SCCH GA Grant Agreement to the project GitLab Version control and DevOps platform gRPC Google Remote Procedure Call in-toto Framework defining attestation format for software supply chains KPI Key Performance Indicator KR Key Result MEDINA Predecessor project of EMERALD MVP Minimum Viable Product REST Representational State Transfer SLSA Supply-chain Levels for Software Artifacts TOM Technical and Organisational Measure TRL Technology Readiness Level WP Work Package D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 7 of 23 www.emerald-he.eu Executive Summary This deliverable presents the initial design, architecture, and implementation state of the runtime evidence extractors Clouditor-Discovery and Codyze-Provenance of WP2. It contributes to the key result KR1-EXTRACT of EMERALD, a framework to continuously extract runtime information of a cloud service and prepare suitable evidence based on them. EMERALD follows a knowledge graph-based approach to provide a unified view of the cloud service under certification at different layers of the service, ranging from the infrastructure layer (e.g., virtual resources), to the business layer (e.g., policies and procedures), to the implementation layer (e.g., source code files) and data layer (e.g., increasingly used AI models) in cloud applications. The runtime evidence extractors, developed in Task 2.5 and described in this deliverable, aim on the one hand at identifying critical security-related functionality such as data encryption, transport encryption, or authentication in cloud infrastructure components. On the other hand, they establish software provenance and artefact attestation to completely track software from its inception as source code to deployed build artefacts. This is complementary to the evidence gathered in Task 2.2. Other related deliverables in WP2, all due at project month 12 (October 2024), provide functional and technical details on further evidence extractors from different sources, i.e., D2.2 [1] on source evidence extraction in Task 2.2, D2.4 [2] on evidence extraction from policy documents in Task 2.3, and D2.6 [3] on security and privacy preserving evidence extraction in Task 2.4. All these details contributed to D2.1 [4] on the overall information model of the certification graph in Task 2.1. This document starts by illustrating how the runtime extractors fit into the overall EMERALD architecture. The main part provides functional and technical descriptions of the evidence extractors Clouditor-Discovery and Codyze-Provenance, including their purpose and scope, the (current and planned) coverage of the EMERALD requirements, and the components’ internal architectures. These descriptions are complemented by information on delivery and usage, as well as on limitations and future work. Finally, the document concludes with a short summary. The runtime evidence extractors described in this deliverable contribute to KR1-EXTRACT by providing next-generation evidence gathering tools and techniques based on a knowledge graph approach. One extractor – Clouditor-Discovery –has currently the initial prototype implemented and is ready to be integrated with other components of the EMERALD architecture. The requirement of the component is already partially satisfied by the presented prototype. The second extractor – Codyze-Provenance – is a new component within the EMERALD architecture and is currently in its initial design phase. Based on the work described in this deliverable, the runtime evidence extractors will be further extended and integrated into the EMERALD framework. This is the first iteration of the deliverable coming from Task 2.5. The second and final version of this deliverable with the updated extractors will be delivered with D2.9 [5] in project month 24 (October 2025). Evidence will be prepared according to the integrated, graph-based model of semantically linked and combined evidence, provided in D2.10 (interim version) [6] in project month 15 (January 2025) and D2.11 (final version) [7] in project month 27 (January 2026). The extracted evidence will be stored and assessed, i.e., to verify the implementation of security metrics, in the scope of WP3. D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 8 of 23 www.emerald-he.eu 1 Introduction EMERALD aims to provide a next generation set of evidence gathering tools and techniques based on a knowledge graph approach. KR1-EXTRACT supports an improved and unified toolsupported approach to continuously extract knowledge from different layers of a cloud service, e.g., infrastructure, platform, runtime information, policy documents, software, and AI models. The objective of WP2 is to establish a unified view of the cloud service being certified, known as the certification target, by extracting and enriching knowledge of the different layers of the service and providing suitable evidence for security metrics. A major part of this work package is research and design of multiple tools and techniques to extract knowledge out of various sources. A graph-based model, called the certification graph (CertGraph), serves as a common structure that is filled by all evidence extraction components. 1.1 About this deliverable The goal of this deliverable is to present the design and implementation of the EMERALD evidence extractors, that extract runtime information from cloud services. This is a report on the initial prototype reflecting an early stage of implementation and integration of the extractor and is the first of two iterations of deliverables, resulting from Task 2.5. Evidence on the runtime information level is gathered by the runtime information evidence extractor Clouditor-Discovery, which supports the CertGraph data model. The ClouditorDiscovery component is based on the respective microservice of Clouditor 1 and was already used in MEDINA 2 . It focuses on generating evidence for security-related findings, such as encryption in use, at rest encryption or restricted ports. While the component was at TRL 5 in MEDINA, it should be advanced to TRL 7 in EMERALD. Another source of runtime information are CI/CD pipelines and their jobs. During the build of a cloud service or application from source code, jobs such as application security testing, software composition analysis and secure software development measures augment the confidence in the security of the final build artefact. Codyze-Provenance is a new addition to EMERALD and currently under design that intends to gather evidence about CI/CD pipeline executions. This evidence would facilitate to assess security enhancing jobs executed during a build in a CI/CD pipeline. Moreover, Codyze-Provenance will provide attestations for executed jobs and link them together to provide provenance. From attestation and provenance reports it becomes possible to track the complete supply chain of software artefacts from source code to deployed artefacts. Furthermore, application-specific runtime information (e.g., found in log files) might be used to provide additional context regarding the executed functionality. For now, it is just an idea and not implemented. 1.2 Document structure The document is structured as follows. In Section 2, we discuss how the runtime evidence extractors fit into the overall EMERALD architecture and their relationship with other components. Section 3 describes the ClouditorDiscovery evidence extractor, which provides the extraction of runtime information of cloud services. Section 4 describes the Codyze-Provenance evidence extractor, which provides traceability and attestation along CI/CD pipelines. For each extractor, we provide functional and 1 https://github.com/clouditor/clouditor/tree/main/service/discovery 2 https://medina-project.eu/ D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 9 of 23 www.emerald-he.eu technical descriptions, along with information about delivery, usage, limitations, and future work. Section 5 ends up with the conclusions of this deliverable. D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 16 of 23 www.emerald-he.eu Figure 2. Overview of the available options for Clouditor-Discovery 3.3.3 Instructions for use Within the EMERALD project, the EMERALD UI is developed and used to access and manage the workflow within the framework. The Clouditor-Discovery is not directly accessible through the EMERALD UI; however, it can be attached to the Certification Target in the EMERALD UI. Figure 3 shows the EMERALD UI view for selecting an evidence collector. Point 1-3 provide additional information about the evidence extractor, while the button at point 4 allows the user to add a new evidence collector. Point 5 displays the current status of the evidence extractor. D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 17 of 23 www.emerald-he.eu Figure 3. EMERALD UI view for setting the evidence collectors for a Certification Target (D4.3 [14]) Figure 4 presents the subsequent view containing configuration information for the selected evidence collector. The specifics of which information will be displayed and what functionalities will be available for Clouditor-Discovery are yet to be defined. Figure 4. EMERALD UI view for the available functionalities of an evidence collector (D4.3 [14]) D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 18 of 23 www.emerald-he.eu Further information regarding the EMERALD UI can be found in D4.3 [14]. Note that the installation of the evidence collectors cannot be performed via the EMERALD UI; however, users can attach individual evidence collectors to a Certification Target. The available user manual can be found in the Clouditor README 16 and the CLI 17 . 3.3.4 Licensing information The Clouditor is licensed under the open-source Apache-2.0 license including all subcomponents such as Clouditor-Discovery. 3.3.5 Download The Clouditor source code can be found in the Clouditor GitHub repository 18 . The adapted EMERALD component Clouditor-Discovery can be found in the public EMERALD GitLab repository 19 . 3.4 Limitations and future work This section describes the limitations and future work for the Clouditor-Discovery component. The limitations are as follows: • Clouditor-Discovery currently gathers data from Microsoft Azure, AWS, Kubernetes environments and CSAF, but its functionality is restricted by the access permissions granted to it in user management systems like Azure Active Directory. As a result, it can only access resources that are visible to the assigned user. • Changes to the cloud provider APIs may require updates to the component. For example, if key security features, such as at rest encryption, are modified, their integration into the EMERALD evidence must be adjusted accordingly. • The evidence collection is restricted by the capabilities of the cloud provider APIs. If a specific encryption feature is not supported by an API, capturing evidence for that feature will not be possible. • Clouditor-Discovery incorporates ontological terms into the evidence; therefore, the constraints of the ontology must be considered: o First, it is crucial that the ontology terms are accurately integrated into the evidence; otherwise, the assessment component may yield incorrect metrics. o Second, the ontology requires ongoing updates, and any modifications must be reflected as well in the Clouditor-Discovery component. o We have already developed a tool called owl2proto that converts the modelled ontology into an appropriate Protobuf schema, which can be directly used in various programming languages. However, the code in the Clouditor-Discovery component still needs to be adjusted for more significant changes. Future work will concentrate on implementing additional discoverers for security-related cloud configurations for the CSPs OpenStack 20 and OpenNebula 21 , aiming to integrate the pilot partners as well. 16 https://github.com/clouditor/clouditor 17 https://github.com/clouditor/clouditor#clouditor-cli 18 https://github.com/clouditor/clouditor/tree/main/service/discovery 19 https://git.code.tecnalia.com/emerald/public/components/discovery 20 https://www.openstack.org/ 21 https://opennebula.io/ D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 19 of 23 www.emerald-he.eu 4 Codyze-Provenance Codyze-Provenance is a new addition to the Codyze component in EMERALD. It adds runtime evidence extraction capabilities to Codyze. It will create a verifiable trail of evidence from source code to running cloud services and applications. This provenance creates a stronger link between static analysis based on source evidence extractors and runtime evidence extractors. 4.1 Functional description Overall purpose. Codyze-Provenance is intended as a realisation of the SLSA provenance framework 22 and the in-toto attestation framework 23 . The SLSA provenance framework specifies measures to harden the security of supply chains for software artefacts. In addition to specifying how each step in a software’s supply chain can be security hardened, it also links the different stages to one another to support traceability and provenance. The in-toto attestation framework provides the technical specification on how to create these links by generating verifiable statements about what went into a stage, what happened in a stage and what resulted from a stage. Codyze-Provenance creates provenance and attestations of software build processes. This information allows to track and verify what data went into a build process, what tools where executed and what artefacts were created. Thus, it becomes possible to trace the origin of a running cloud service and application back to its specific source code and corresponding build process. Codyze-Provenance will provide the necessary tool and supporting components to realize SLSA and in-toto in a CI/CD pipeline. Moreover, it will submit provenance and attestations to the Evidence Store for further assessment. Context and scope. Codyze-Provenance needs to be integrated into a CI/CD pipeline and executed on every run of the CI/CD pipeline for a cloud service or application. It will adjust the build process to support the generation of provenance and attestations. They are collected and transformed into evidence within the EMERALD framework and submitted to the Evidence Store. Motivation. One challenge during runtime is to verify the origin of a running cloud service or application. Usually, it’s still possible to identify the container image or binary that is running. However, it becomes increasingly difficult to provide details on how the service or application was built, which built steps were executed, or what source code version was used in the build. A complete software supply chain would describe all resources and process producing the final deployable service or application. This provenance allows to verify requirements such as mandatory security testing of applications or security checks for dependencies. Moreover, a strong link between sources and build processes on the one hand and the runtime on the other hand is created. Requirements. Currently, Codyze-Provenance is a new addition in EMERALD and corresponding requirements still need to be defined. Innovation. Codyze-Provenance provides a user-friendly approach to integrate SLSA and in-toto into software build processes for cloud services and applications. Collected evidence enhance the ability to assess compliance with respect to compliance schemes. 22 https://slsa.dev/ 23 https://in-toto.io/ D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 20 of 23 www.emerald-he.eu 4.2 Technical description The following subsections outline the technical details of Codyze-Provenance as they are envisioned. 4.2.1 Prototype architecture Codyze-Provenance will consist of an application that collects provenance and attestation reports defined by the SLSA and in-toto framework. These reports are transformed into evidence for EMERALD and submitted to the Evidence Store. In addition, Codyze-Provenance will provide templates and supporting files to create a CI/CD pipeline that supports the generation of provenance and attestation reports. At this stage, a more detailed prototype architecture cannot be presented because CodyzeProvenance is still in its initial design phase. 4.2.1.1 Sub-components description At this point of planning, no details on possible sub-components can be provided. 4.2.2 Technical specifications Codyze-Provenance will be developed in the programming language Kotlin with a Java Virtual Machine as backend. Moreover, it will provide templates and other supporting files to facilitate an integration into CI/CD pipelines. To this end, the focus is on GitLab, which is also used as the repository and CI/CD platform in EMERALD. Further details will be provided in the next iteration of this report on runtime evidence extractors in D2.9 [5]. 4.3 Delivery and usage The following subsections detail the delivery and usage of Codyze-Provenance. The provided information is currently work in progress and may change. 4.3.1 Package information Codyze-Provenance will be delivered as an application bundled in an archive. The structure of this package is summarized in Table 4. Table 4. Overview of tentative package structure for Codyze-Provenance Folder Description bin/ Contains execution scripts for Windows and Linux/macOS docs/ Contains detailed documentation etc/ Contains sample configuration files and supporting files lib/ Contains application and dependent libraries LICENSE License text (Apache License, Version 2.0) README.md Short documentation including short summary description, installation and usage instructions, and further information 4.3.2 Installation Installation instructions will be provided as part of a README and documentation for CodyzeProvenance (cf. Table 4). D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 21 of 23 www.emerald-he.eu 4.3.3 Instructions for use Instructions on how to use Codyze-Provenance will be provided as part of the released packages (cf. folder ‘docs/’ and ‘README.md’ in Table 4). This information will also be available in the public GitLab repository24 of EMERALD. 4.3.4 Licensing information Codyze-Provenance will be licensed as open source under Apache License, Version 2.0. In addition, it is ensured that third-party dependencies are compatible with the Apache License, Version 2.0. 4.3.5 Download Codyze-Provenance will be available from the public EMERALD GitLab repository 24 hosted by Tecnalia. The repository is going to host the source code, the documentation, binary artefacts and supporting materials. 4.4 Limitations and future work Codyze-Providence is a new component added to the EMERALD framework. It is currently in its initial design phase and many of its details are yet to be specified. Hence, the goal is to have an initial MVP as soon as possible. 24 https://git.code.tecnalia.com/emerald/public/components/codyze/codyze-provenance (WIP) D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 22 of 23 www.emerald-he.eu 5 Conclusions The EMERALD project proposes a holistic approach to evidence collection, encompassing all levels of the cloud service from the infrastructure layer (e.g., virtual resources) to the business layer (e.g., policies and procedure), and the implementation layer (e.g., source code files). This deliverable contains the technical report on the design, architecture, and current implementation status of the runtime evidence extractor components of Task 2.5 ("Extraction of evidence using runtime information"). The components adhere to the overall EMERALD framework and align with the technical requirements gathered within the scope of WP1. The deliverable outlines the relationship of the presented components with other components of the EMERALD framework and details the internal structure, subcomponents, and technical implementation information of each component -- as far as known at the current time. The components introduced in this deliverable include the runtime evidence extraction components Clouditor-Discovery and Codyze-Provenance. The Clouditor-Discovery component was already used in MEDINA and has a working prototype that can be integrated into the EMERALD framework. It has been enhanced to incorporate a variety of discovered resources and the use of the newly developed Owl2proto tool for the automatic generation of the necessary Ontology objects. Codyze-Provenance is a new addition to the Codyze component, which will extract evidence from CI/CD pipelines and provide attestations and provenances for software builds and artefacts. It’s currently in its initial design phase, with details yet to be specified. In the upcoming phases of the project, the Clouditor-Discovery and Codyze-Provenance components will be further developed and integrated into the EMERALD framework. The next and final iteration of this deliverable will provide the updates on these components in project month 24 (D2.9 [5]). D2.8 - Runtime Evidence Extractors – v1 Version 1.0 – Final. Date: 31.10.2024 © EMERALD Consortium Contract No. GA 101120688 Page 23 of 23 www.emerald-he.eu 6 References [1] EMERALD Consortium, “D2.2 Source Evidence Extractor – v1: Evidence extraction from source code that can be integrated with the certification graph,” 2024. [2] EMERALD Consortium, “D2.4 AMOE – v1: Evidence extraction from policy documents that can be integrated with the certification graph,” 2024. [3] EMERALD Consortium, “D2.6 ML model certification – v1: Security and privacy preserving evidence that can be integrated with the certification graph,” 2024. [4] EMERALD Consortium, “D2.1 Graph Ontology for Evidence Storage: Description of a uniform schema for storing and linking heterogenous data,” 2024. [5] EMERALD Consortium, “D2.9 Runtime evidence extractor – v2: Evidence extraction from runtime data that can be integrated with the certification graph,” 2025. [6] EMERALD Consortium, “D2.10 Certification Graph– v1: Integration of the graph with semantically linked and combined evidence,” 2025. [7] EMERALD Consortium, “D2.11 Certification Graph– v2: Integration of the graph with semantically linked and combined evidence,” 2026. [8] EMERALD Consortium, “D1.1 Data modelling and interaction mechanisms - v1,” 2024. [9] EMERALD Consortium, “EMERALD Glossary,” 2024. [10] EMERALD Consortium, “D3.3 Evidence assessment and Certification–Implementation-v1,” 2024. [11] MEDINA Consortium, “D3.6 Tools and techniques for collecting evidence of technical and organisational measures-v3 (https://medina-project.eu/public-deliverables/),” 2023. [12] EMERALD Consortium, “D3.1 Evidence Assessment and Certification - Concepts - v1,” 2024. [13] C. Banse, A. Schneider and I. Kunz, “owl2proto: Enabling Semantic Processing in Modern Cloud Micro-Services,” To appear in: 16th International Conference on Knowledge Engineering and Ontology Development. [14] EMERALD Consortium, “D4.3 User interaction and user experience concept - v1,” 2024.